Which gets you into that boring part of actuary calculations. In seismically inactive parts, "bye-bye and rebuild (while the cluster is running from a geographically remote datacenter, and only a slight increase in latency indicates this)" could be an order of magnitude cheaper, and thus preferable. In other words, downtime is not replaceable, hardware is.