In my work (desired hi-rel electronics) there is sometimes the dilemma, how complicated to make something, by adding protections / alternate control paths. The answer is not easy, as protections are more complicated to analyze and come with lots of potential other problems. I tend to prefer to make sure that the simplest design stays and remains robust. I seem to observe that for some who do not wish to go into details, it appears easier to recommend some extra layers be added.