Bloggs
So, Boeing keeps TOGA active after touchdown. Some pilot inadvertently commands TOGA after landing, the aircraft goes off the runway. There would be a 50 page thread here discussing how stupid it is that Boeing didn't inhibit TOGA after landing.
As a designer, you simply cannot protect against every inadvertent switch or button push. If you want to claim no pilot would ever inadvertently push TOGA after touchdown, I can provide a list as long as my arm of cases of pilots who have inadvertently actuated flight deck switches, including shutting down engines (or the wrong engine) - and two cases where the pilot shut down BOTH engines at less than 3,000 ft. during takeoff.
As a designer, we also have to be extremely sensitive to 'unintended consequences' where you change the design to address one failure mode, and create a new failure mode that is even worse. A very unpleasant example is the 'fix' for the Cranbrook 737 crash (
https://en.wikipedia.org/wiki/Pacifi...nes_Flight_314), where they rejected the landing after the T/Rs were deployed, one reverser didn't completely stow and lock prior to liftoff. The aircraft design removed hydraulics from the reverser in 'air' mode and the aero forces redeployed the reverser at low altitude. The 'fix' - auto-restow -was ultimately responsible for an even worse crash - Lauda 767 (
https://en.wikipedia.org/wiki/Lauda_Air_Flight_004) when it allowed hydraulics to the T/R in-flight...