I imagine the process of "building a failsafe" is just as bug-prone as writing the main contract. It's just more code, after all.