A single booleans file is a problem for updates/upgrades that introduce new booleans, if you've ever modified the booleans file before. The new settings will be in booleans.rpmnew, and new `active' defaults won't take effect. One possibility to overcome this problem would be to only add booleans that defaulted to false. Another possibility is to switch from a single booleans file to a directory structure: booleans.d/<property> containing either 0/1, or <property>=0/1. The latter won't waste space and makes it easier to cat them all together, but it makes room for introducing unrelated settings under different filenames. It's more work in maintaining the rpm, for sure, but it makes for cleaner upgrades.
I have switched to using booleans.local instead of just booleans. So now /etc/selinux/TYPE/booleans is config and booleans.local is config(noreplace)