I'd say it's fine in the specific range where malfunctions can be expensive, but total failures aren't.

You pointed at one end of that, where the failure is equally expensive. From the other end of it, I attempt to build my Minecraft mod such that partial failures are transient and local, rather than bringing the entire game down.