"not something that can be done with a single mistyped command. "
My point exactly.
Yes servers have to be taken down. Yes sometimes clusters of servers have to be taken down. But it should be very rare that all need to be taken down at the same time.
And it should be impossible to do so without whoever's doing it realizing exactly what is about to happen.