Not sure why this is controversial. Boilers have an on/off switch, and when your company manages a large number of buildings, you automate and centralize on/off for efficiency's sake, no?
The management system can then receive information and MAYBE control some aspects of the heating system. If you remove or crash the management system, the heating system just reverts back to being a "dumb" heating system.
My question is: Why in the name of all that is holy does the heating system stop working just because the remote management interface decides to reboot?
This has to be design by the same idiots that believe that an in car infotainment system should be hooked up to the drive computer in a Jeep.
If there's already a fire present, whether furnace decides to stop operating or not is usually irrelevant (you can get a gas leak from a damaged furnace even if it's off). I do not see why _remote_ control should be able to prevent a fire from starting: whatever is remotely controlling this furnace doesn't have more data than the furnace itself.
So, in this case, "burn at max rate" _is_ the safe setting to be used when the controller dies. The only unsafe situation that it will cause is that the hot utility water will be scaldingly hot, but there will be no increased danger of fire nor of CO poisoning.
In essential systems you have to build for robustness over efficiency.