Aurora isn't really designed to handle the total failure of two availability zones (not short term, anyway). It's designed to handle one AZ + one additional node failure (which is reasonably likely to happen on large instances due to data from a single database being striped across up to 12,800 machines per AZ). Due to how quorum systems work the "simplest" way they decided to handle that was six replicas per 10 GiB segment across 3 AZs, with three of the replicas being log-only and three designated as full replicas (which is the lowest number of full replicas you can have given their failure model, and hitting that lower bound does require you to deploy across 3 AZs). If any three of the nodes are dead (log-only or otherwise), write traffic is stopped until they can bring up a fourth node, though there is some support for backup 3-of-4 quorums for very long-term AZ outages.