It's as much about how you set it up as the hardware itself.
Fail off is a bummer and could be a major prob if you don't notice or on a week-long vacation.
Fail on, as you saw, kills everything while you sleep or are at work.
The week point for the controller is the temp probe. For the heater, it's the thermostat relay that can fail to make a connection (stuck off) or weld itself connected (stuck on). Whether it's an apex to a temp controller to a heating element.. OR.. a temp controller to a heater's integrated thermostat, to the heating element.. you want at least one redundancy.
Then, there's a couple ways to do it. 1) set your temp controller to 79 and your heater to 80 and let the temp controller relay and probe handle the switching on/off. If the temp controller fails, you should still max out at 80... or 2) set your heater to 79 and your temp probe to cut power at 81. That lets your heater's relay handle most of the on/off switching and the temp probe acts as the safeguard to "stuck on."
Some will connect one temp controller to another to a heater with a thermostat, all driven by an apex. While that will make a "fail on" next to impossible, IMHO, it also makes a "fail off" more likely. Anytime the furthest upstream probe fails, you risk losing power to everything downstream.... plus the complexity begs for human error.