Defensive programming favours failing loudly at the point of the error over continuing with a plausible substitute. Why is crashing sometimes better than carrying on?

D. Because a fault that surfaces immediately is localised and diagnosable.

A function handed a negative length that quietly returns 0 has moved the failure elsewhere and removed the evidence, the wrong value flows on and surfaces in innocent code. It is not a rule about production behaviour: a web server should return an error, not exit. The distinction is between expected conditions, handled deliberately, and bugs, where an assumption is false.