We do the same thing but we keep up on the changesets instead of waiting for the tagged releases. We export out a patch from trac.mu, import it to a local test install, test it, apply it to our SVN if it works else editing it until it does, and then export out the patch out of our SVN and apply it on our installs.
I stress the "We test it first" bit up there. We don't apply patches blindly.
We do it out of the changesets as it keeps us up on bug fixes and security concerns. That's important to us. We host and "watch over" a large number of mu sites and to have our clients months behind what's current is not acceptable to us or to our clients.
We have a fair amount of custom code within our mu installs though as we would rather apply our code changes directly to the code base instead of plugins when possible. That may or may not work for you.