The option to fail one Sensor closed and one Sensor open was intended for use with active-passive configurations. When the order in which the redundant paths will be used is known, you can safely configure the Sensor on the primary path to fail closed and the Sensor on the secondary path to fail open. The result is as follows:
If the Sensor on the primary path fails, it will force the secondary path to take over, which will ensure the link remains protected.
In the unlikely event that the secondary path has become active and the Sensor on it fails as well, traffic will no longer be scanned, but will continue to flow.
You might prefer to shut down the Internet connection if the traffic on the secondary path cannot be scanned for intrusions. In this case, you would configure both Sensors to fail closed.
On a network on which both paths are active, there is no way to predict the order in which the paths will fail. Configuring a Sensor to fail open in this context would at best negate the purpose of the Trellix IPS redundancy. Furthermore, if there were asymmetric flows on the paths, the remaining Sensor would not see all the packets from those flows and therefore be susceptible to false positives and false negatives.