That sounds terrifying

True, but it’s the safest configuration because you want the default condition to abort. The inverse set up is less safe because there are more failure modes for a receiver to break, meaning if a abort command was sent there’s more chance it won’t respond. It’s like choosing a normally-open or normally-closed valve; you want the default (power off) configuration to be the safer one. Inadvertently aborting is safer than not aborting when you should have

I don’t disagree, but that is in fact how it works!

RUD: Rapid Unscheduled Dissassembly

I prefer the term distributed landing.

I’m hereby notifying you that I have now appropriated that term for my own future use. :)