So a single failure of a prototype means its never ever ever gone work? What kind of logic is that?
Also you are wrong. SN9 actually used 2 engines for the flip, not 3.
They only swapped to 3 for SN10 and the flipped worked perfectly there. The problem with SN10 was the temporary helium system they put after SN8 in so the engine was ingesting helium.
The point is that you have engine out capability both on the flip and during landing. Of course over time SpaceX need to test some of these profiles in more detail, just as they did for Falcon 9 where they tried various ways of landing.