This is of course true as a blanket "gotcha" headline- although I wouldn't call a failed test the CI itself failing. A real failure would be a false positive, a pass where there wasn't coverage, or a failure when there was no breaking change. Covering all of these edge cases can become as tiresome as maintaining the application in the first place (of course this is a generalization)
100% coverage is an EXPTIME problem.
> a pass where there wasn't coverage
I always feel obliged to point out that we can have 100% coverage without making a single assertion (beware Goodhart's law)