The jump to simple solutions in hindsight bothers me. Especially with software in complex safety-critical systems it's often incredibly hard to capture all the permutations that can lead to a failure mode.

I wouldn't doubt most programmers could do an failure mode effects analysis on the software and figure out they need to mitigate an event where the timer fails to sync. But how many would also capture how to mitigate that sync failure at the precise time the system lost satellite comm? Probably a heck of a lot less.

Now multiply that by the total number of software failure modes (including those latent ones we just get lucky with) and see how many get captured. There's a reason why software in these types of systems is incredibly hard to test.