* The OS is is always read-only. While this doesn't prevent all possible corruption scenarios, it's pretty close and you can be quite sure the system always boots.

* System updates are implemented as A/B. So even during updates, the OS the system booted from isn't touched.

* All content data is on a third partition and together with the OS files is constantly checked for indications of corruption.

* If the OS detects any bit error on the OS files, it is reinstalled (using the A/B mechanism above)

* If there's a bit error on any of the content files, they are deleted and downloaded again

* If the content filesystem is broken beyond repair the system reformats everything and restores everything automatically by redownloading

* Various watchdogs and checks constantly monitor system health and notify you on the dashboard.

The service has multi-million hours of service by now and the only case of filesystem corruption was due to a really crappy SD card. When done properly, the Pi can be reliable. That's also the reason why there is no way to properly shut down the system. Just unplugging power shouldn't be an unexpected circumstance but something you optimize for. Starting with a normal Raspbian and expecting that to work is a bad idea.