particularly when only two are required in order to identify that one is sending bad data and trigger the "AoA Disagree" warning that the Max already has provision for.
I don't follow that. Sure, if one sensor goes back, it's detected, and MCAS is disabled. But that's my point. If MCAS is needed for airworthiness, how big a deal is it when it goes inop in flight? If I was an xAA, it's a question I'd be asking.
Some quick mental arithmetic says the MAX fleet had accumulated ~1 million flight hours when grounded (within a factor of 10). So AoA sensor failures are happening every 500K flight hours (actually more since sometimes it's the inactive one and nobody notices). When there are 5000 aircraft out there, that's a failure every 20 days or so. If MCAS is necessary... what happens when an aircraft has a failure and then, say as a result of an RA, enters the condition MCAS is supposed to handle? And it's one of these low-time minimally-trained crews that are the reality of airlines today - maybe the resurrection of the PF on AF447?
As has been said many times, there are going to be a lot of red faces if there is another hull loss because of MCAS, or the underlying aerodynamic problems which prompted it. I would sure want to be careful not to be one of them.