> the error could also be more obvious and the code just fails open. someone has a try/catch and returns true either because of an accidental mistake or because they don't want users to be locked out when the provider is down.

Failing open would be a catastrophic mistake either way. "The auth provider is down, just let everyone in!"