Brett:
I have had one unexpected start since going electric. Not at the field. I was doing a runup when it quit after about 10 seconds and it stopped. As I was setting it back down it started back up again. It was a loose wire between the ESC and timer. Why it behaved that way, I am not qualified to even guess. The likelihood of a restart from a normal cutoff is almost zero with my equipment because it requires a re-arming of the ESC but a restart from a non scheduled stop should be suspect.
I think you are wrong on that one - very low, but your "rearming" procedure is not going to fix it. There are a myriad of what are called "low-level" states in your timer and controller, that is, states of the processor that are "stored" as logic signals, essentially acting as solid-state "relays". They are always - repeat *always* subject to changing state unexpectedly, from anything from static electricity (far too low for you to notice) to cosmic rays. Your computer is also subject to this, too, but it uses "EDAC" (error detection and correction) that stores more bits that it actually uses, the extra bits being set based on the 32 or 64 bits that it uses, and can be used to detect unexpected bit flips. Usually for consumer equipment it can correct a single bit flip, but only detect two bits, at which point it halts/crashes.
Same thing can happen with any - repeat, *any* - low-level logic signal, and that can cause unexpected behavior. I have seen or seen the results of *thousands and thousands* of these bit flips, even in the highest=end military equipment. They, however, are usually designed to recover from this with no outside interventions, for the most part, having separate equipment to detect a halt or fault, and rebooting it, restoring memory from protected checkpoints, etc. Some trivial examples are not protected against, and the states just change, and you fix them later. Early on in the space age, this sort of thing was not protected against, and the spacecraft just went out of control and sometimes ended up dead as a result.
The controllers used in stunt are not that prone to this problem, but they have nearly zero robustness/built-in recovery methods. A lot of the glitches just cause odd behavior or shuts it off, or are cleared on the next processor cycle. A few will turn it on (assuming that the battery is connected). Those are the ones this rule is protecting against.
Note that this says nothing about *failures*, but the rule still prevents a failure from having the motor run amok when you don't expect it or might take off on its own.
Brett