I agree with you Tim. If the probability of a single failure is fairly remote, the probability of the double failure is very remote, not just half.
There are some possible failure mechanisms that can result in total failure. When one system fails, one piston goes to the limit and the other moves into a position that it normally doesn't travel. If the MC is in poor shape inside this change in position could result in failure of the seal on the second piston. In any case when one half fails, the pedal will most likely go to the floor and a second stroke will be necessary to gain some pedal.
