Update: I read through a lot of the Marlin slow-reference guide on endstops. It turns out 3D printers basically have what I would call a homing sensor, and don't have proper axis end stops at all, although sometimes the homing sensor performs some of the functions of an endstop.
It seems that Marlin, at least, does not have any provision for endstops as distinct from "homing sensor". Nor does it have any provision for dual endstops...the assumption is that you will use exactly one sensor, and it will be used primarily as a homing sensor and ignored most of the time (more on bed probing later). This is "bad" machine design but seems to be status quo for printers.
Marlin does have "software endstops", which is what normally protects the ends of the axis against some failures. A software endstop does NOT protect against all failures, though. There is no support for a second hardware endstop by default. You could hack Marlin to add one, and consume another controller pin, or you could implement a second endstop simply by installing it and wiring it "normally closed" in series with the primary. But, since the firmware ignores the harware endstops most of the time, even a second hardware endstop would simply be ignored anyway.
There are a bunch of home offsets in the firmware, including bed-mesh offsets, and ultimately most of them depend on the ability to move the axis PAST the endstop/home sensor trigger point. This requires both a switch that can be "over-pressed", and requires IGNORING the sensor during printing...relying on some software endstop PAST the hardware endstop, and making the switch then worthless as an actual endstop. There does exist an option in Marlin to continuously monitor the hardware endstop, but if you enable it, you will not be able to utilize any modes that result in over-driving the axis past the home position...such as bed leveling that drives into "dips" in the bed, and it forces you of course to set your home position at or below your first-layer height of any print you might make; there is no way to leave any "safe margin" then.
Assuming you ignore the endstops in the let us call it "default" way of running, it is necessary to have a switch that can be over-pressed somewhat. The worst-case scenario would seem to be a microswitch with no lever, which probably has an "over-press" tolerance of a couple hundred microns at most. If you set one of these to trigger at Z=0 (nozzle on bed), even a slightly warped bed (my X1 is almost 1/2mm low in the middle) might result in triggering (in the case of endstop monitoring) or even physically smashing the switch in the course of normal printing, since the firmware allows driving the axis past the endstop.
Since the endstop is normally ignored during printing anyway, it doesn't really matter where it is...it could be several mm up, just as long as it could be over-driven that same several mm. So an endstop with a decent large amount of "over-travel" tolerance would be best here, allowing you to set a home position with a couple mm of safe margin, and still drive past it to do all of your printing. The best would be a flag through an optical sensor, which would have infinite (as wide as your flag) "over-press" tolerance (the downside here is these are accurate but not considered as reliable as mechanical microswitches for ensuring machine safety). IWorst would be a bare microswitch with probably a fraction of a mm of over-press tolerance. In between, would be microswitches with levers, and inductive sensors, both of which might have a couple mm of "over-press" tolerance (you could imagine mounting a bare microswitch to a flexible or spring-loaded mount with a higher spring constant than the switch itself but that might be silly). So if you are going to use the default operation of ignoring the "endstop" during printing, the endstop becomes the homing sensor, and there effectively is no endstop, you might as well set your home position a couple mm over the bed and use a sensor that can be over-driven, because over-driving is assumed and endstop is ignored during printing anyway.
Enter toolhead probes: Marlin allows you to either use the toolhead probe AS the combined endstop/sensor, or in addition to it. When using a toolhead probe AS an endstop, its performance as an endstop proper is nearly zero, since the signal is systematically ignored during printing -- the option to keep endstops enabled is not possible because an inductive probe is nearly always triggered during first-layer printing, and a servo probe must be stowed, so these cannot protect from a crash. The plus side is these sensors intrinsically have a large "over press" tolerance by their nature...there's no chance of damaging them by driving the axis too low. As a homing sensor, their performance is probably fine, with the benefit of course of triggering of the bed itself. Minus that advantage, they are basically endstops with an infinite over-press tolerance and no ability for continuous monitoring. Since most people probably didn't use endstop monitoring anyway, they might consider this an improvement.
Instead of using the toolhead probe AS the endstop, Marlin will let you have both. In that case, the printer homes off the fixed endstop. Then, the toolhead probe is used to update offsets for printing and leveling. All the previously mentioned limitations of endstops apply, such as the need to have over-press tolerance if the axis will ever need to move further than the home switch (such as in the case of a dipped bed or a thinner installed bed), the inability to constantly monitor the endstop, thus uselessness as an actual endstop if over-press is used as part of normal operation. I would say using a tool head probe allows you to gain some protection from changing nozzle height and bed thickness, but you permanently forfeit ability to have an operating endstop. Since most people probably didn't use endstop monitoring anyway, again, they might consider this an improvement.
Where does that leave me designing a printer? Well, aside from something like TAP, it seems there's no technology out there that will actually protect the nozzle from hitting the bed. I don't want to hack Marlin to add real endstops or dual endstops, and I don't have plans for a toolhead probe at the moment. What I will probably do is use a microswitch with a lever, because these have generous over-travel tolerance, and wire it in series with another switch on the other side so I at least have dual hardware end-stops. If my bed happens to be mechanically level to within 0.1mm (very unlikely), then I will enable endstop monitoring, but if any leveling correction beyond that, I will have to disable it and just run blind.