apt-get may be a little open for e-smith; besides which, most mirrors only host the ISOs.
However, the idea shouldn't be disregarded. Now e-smith has been bought out, the parent company could maintain a site with a large amount of bandwidth from which security updates (and only security updates -- I am not a believer in constant updating on a whim) could be manually or automatically downloaded by e-smith servers.