It's worse than this. MCAS is designed to only look at one of the two AoA sensors. If this happens to be faulty, it doesn't know, because it's not comparing the sensor to the other one. Instead of a system which can notice and account for disagreeing sensors and fail gracefully, we have a system which is a designed single point of failure and fails... lethally.