That’s why the extra redundancy. The probability of 2 or 3 disks failing should be significantly lower than 1 disk failing. I currently run 2-disk redundancy. If 1 disk fails, I’d replace it. If a second disk fails while the replacement is being resilvered, I’d shit a brick, stop the resilver and make an incremental backup to ensure I won’t lose data if another disk fails due to the resilver load. Then I’d proceed with the resilver. RAID is not backup and the extra redundancy is there to reduce the probability to have to spend time restoring backups. Increased redundancy can compensate for individual disk reliability.