Only when things really become terminal. Above all, it is still a competition and going into limp home/shut down mode means forfeiting the race. I think they'd much more prefer the risk on damage and see if they can correct the issue, which is what Mercedes did. They have confirmed there is damage (which I think will likely lead to a PU change), but the trade off is that they won the race.
But yes, there are fail safes in place. I think this happened to Renault a couple of years ago on Spa.
Note that having an issue on a sensor does not immediately mean it is outright broken. A faulty sensor could just as well send out wrong measurements to the ECU. This is what I definitely had on my car because the car not did go into any safe mode; the check engine light just flickered on my dashboard. The lambda sensor still was active, but was faulty (the engine had a correct combustion) and both tried to change combustion (which would be a wrong correction) and send an indication to my dashboard.If lambda sensor is broken there will not be signals to ECU
It's difficult to make any reasonable guess on how this all works out in a F1 PU, which is loaded up with dozens and dozens of sensors. It takes a whole department back at the home base of Mercedes just to keep an eye out on telemetry. So definitely it is vastly complicated. And let's not forget, it doesn't have to be a sensor issue.