Yes it must be a on/off like the VE100 is. The herpstats offer the most advanced safety systems on the market the VE series offer the most basic systems (helix as well) The ecozone and herpkeeper are in between.

I guess it depends on how you define failsafe I have always used a devise that in the case of a failure responds in a way that minimize the damage due to the failure. The secondary T-stat certainly does this. If used with a herpstat and with the relay and low temp shut down enabled it is a triple safe as the primary has a principal function and a secondary back up system built in the third is the second T-stat.