What is this screed even trying to say? "Someone might reuse your failsafe in a way that actually makes it dangerous"? Then it's not a failsafe anymore and the

What is this screed even trying to say? "Someone might reuse your failsafe in a way that actually makes it dangerous"? Then it's not a failsafe anymore and the second designer is an idiot. Like with the firehose example, it isn't the pumping that will kill you it's the not-pumping, therefore your failure state should halt the not-pumping.