Having seen a similar bug on humble Netscalers, and found a much shorter reboot quite difficult to schedule, I do believe the operational challenge here.
The difference being that setting up NS HA, then failing over to the secondary and rebooting in turns is a lot easier than doing the equivalent on a plane. So even considering the operational requirements are the same (no time to reboot but if you don't, people die), you still have a lot more flexibility.
The problem with an airplane is that by the time you find such an issue it becomes prohibitively expensive to fix if an "architecture" change is required. This is why workarounds are provided instead.
