One (amongst many) NTP server going down creates less issues than an NTP server spreading wrong time.

If your application is so critical that NTP timing loss causes disaster and your holdover fails in less than a day and you aren't generating your own via gps, you are incompetent, full stop