A defect produces a refusal rather than a loss

A transition that cannot be proved does not occur, so a defective predicate refuses transitions instead of admitting wrong ones. Your worst day becomes downtime. For anyone holding other people's money, that trade is the entire conversation.

Whole bug classes have no purchase here. Reentrancy does not exist, because nothing executes and nothing calls out mid-execution. Opcode-level and compiler-level failures do not exist, because there is no bytecode and no compiler-to-bytecode mismatch. The proxy-upgrade bug class does not exist, because state is governed by the predicate attached to it, and a move to different rules is explicit and visible rather than swapped in behind a constant address. Out-of gas half-states do not exist, because nothing meters execution and nothing halts partway.

Denial of service inverts. In a proof-carrying chain the computational cost falls on whoever produces the proof, which is the party submitting the transaction, so a deliberately expensive predicate harms only its own author. The network's scarce resources become bytes and persistent state rather than execution time, and pricing those two things deliberately is exactly what the economics page is about.