Looking at the Thales/Boeing design and the FAA special considerations, it appears that the approach was to assure cell failure would never occur--as it seems self-evident that no serious measures to avert propagation to adjacent cells were employed, nor were serious measures to contain damage to nearby systems.
Imho, they did not bother to mitigate cell failure spreading to other cells as this would be weight and size prohibitive (likely worse then NiCd and not near certain to work either).
Rather, the approach seems to be to contain a _rare_ failure inside a solid box and mitigate over pressure by an elaborate venting system out the pressurized vessel.
It worked, twice, resulting in a fart out of the tail pipe and some leakage and one bent box likely due to internal arcing ignited oxygen fed combustion after breakdown of the electrolyte.
All that seems acceptable for a rare failure. It is by no means the equivalent of a hub failure.
What is unexpected and not reasonable is that 2 out of 100 or so batteries in service fatally fail within about year. Two points really do not add up to a curve, but the fact still is of great concern