The assumption is nodes are in different fault domains so it'd be highly unlikely to ruin the whole cluster.

LMDB mode also runs with flush/syncing disabled