So, technically I don't see any problem.

Well the problem _is_ there, so please do see it.

The fact that there is a mitigating control does not eliminate the problem, it merely dissipates temporarily (since this is a manual control, once the manual intervention ceases, the problem will re-emerge).

The default state is never "pedal to the metal". If something should fail - it should "fail-stop", and not "fail-to-full-throttle".