A region is a city. An availability zone is a building in it — its own power, its own cooling, its own network, far enough apart to fail separately and close enough to talk in about a millisecond.
Three choices follow from that. One AZ means one building's problem is our outage: cheapest, fine for dev, test and anything non-critical. Multi-AZ survives a building, costs very little more, and is the right default for almost everything. Multi-region survives a city, a severed cable or a bad deploy in one place, and makes the data agree across a continent, which is the expensive part.
The uncomfortable bit is what redundancy does not cover. Buildings rarely burn down. What actually takes a system out is a configuration change, a bad release, an expired certificate — and those travel everywhere we deployed them, instantly, by design.
Which makes blast radius as much a question of process as of geography. Deploy to one zone first. One region first. One percent of traffic first.
Redundancy protects us from the world failing. It does nothing about us failing everywhere at once.