That's a dramatic over-simplification. You have redundant / clustered firewalls that allow for testing configuration changes before they're deployed everywhere

That's a dramatic over-simplification. You have redundant / clustered firewalls that allow for testing configuration changes before they're deployed everywhere so you never end up in a situation where you have to "fail closed". You have redundant links into critical data centers, either hot/hot or hot/warm. You have redundant power supplies in the racks running the firewalls and routers. You have redundant data centers (where necessary).