Mosfet failure in DC-DC switching converter: root cause analysis and countermeasures
Well, this is quite the puzzle, isn't it!
Let's break this down into a list of potential clues as to what caused the failure:

Converters are efficient and do not get particularly hot (60°C might as well be frigid in the context of power converters and power MOSFETs)

Odd black discoloration can be found on the pads of the broken FETs, and strangely, also on the pads of the output capacitors.

The bottom pads of Q17 and Q19 are supposed to be short circuit (they're both connected to Vin).  However, the bottom pad of Q18 is connected to the switch node of the Q17/Q18 output and ground.  Q19's source is connected to the switch node of the bottom output.  MOSFETs that 'blow' almost always blow closed - that is to say, they get leaky or basically unable to turn off, and the drain and source become shorted. If Q19 failed, it would reuslt in a short betweein Vin and the lower switch node.   This would not cause the bottom pad of Q18 to be shorted to VIN.  In fact, the only MOSFET which could fail and result in Q18's drain being shorted to VIN is Q17.  Unless Q17 also failed, then the failure of Q19 was not the failure mechanism, but rather the result of the failure mechanism.

You have a lot of humidity and daily thermal cycling.

The failed board has solder, not flux balled up dangerously close to the very pads which were shorted.  Yet, this board worked for 18 months without issue.


Believe it or not, those are all the clues we need.  This mystery can be solved.
First off, your footprints for those MOSFETs are likely slightly incorrect.  Your solder paste apertures are likely the problem - basically you're dispensing slightly too much paste, and don't have the location of the paste correct.
See, those little balls of solder aren't just hanging out there, they're attached.  They're attached to the bottom pad, which has little exposed bits of lead frame on either side:

See the exposed parts of the drain on the sides without any proper pins?  If you have too much paste on your drain pad, the excess can ball up on those little side-bastards.  It balls up because there is nothing but solder resist in all directions, so it latches onto that little bit of exposed drain pad, desperately.
Now, you have to factor in manufacturing tolerances for this sort of thing.  I would not really consider this a defect, but rather well-within the normal amount of variation and tolerances you can expect with manufacturing.  Solder doesn't always reflow exactly the same way, and if there is too much paste in the wrong spot, escaping flux and other volatiles can push it to places you'd rather it not go, and you get things like the balling you see on this board, and you get it occasionally.  One in x number of boards might have this, while the rest do not.  It's a roll of the dice.
If you're not explicitly going out of your way to reduce the drain pad paste aperture in your footprint, then it is wrong.  The aperture that works for other pads is too large for the drain pad on PQFN-8/PQFN 56 type MOSFET packages. If I had to guess, I'd wager you have the aperture set to 80% on that pad.  It needs to be reduced to 60% to eliminate any chance of solder balling.  Don't worry - it'll still be enough and won't cause voiding.
OK, now to the real meat of this mystery.  All that aside, those solder balls couldn't be the cause, because the board worked for 18 months without issue.  At least, one would think.
However, they are the cause.  Or rather, those balls along with an unfortunate combination of circumstances are the cause.  We already know that the observed MOSFET failure cannot explain the shorts we see.  Indeed, the only way I can see that the switch node of either output could become shorted to Vin without the topside MOSFET failing is by a physical galvanic connection.  In other words, some metal is touching some other metal where it shouldn't be.
Let's look at our other clues.  You mention humidity.  But, there is always humidity.  When does it actually become a problem?
When it is sufficient to cause corrosion.  You're using a lead-free solder, yes?  Maybe SAC305, or similar?  Whatever it is, it has a little bit of silver in it.  In the presence of significant humidity and a bit of heat (50-60°C is plenty, and the output capacitor would be another hotspot as it is dissipating some power from the ripple current it is dealing with), the silver in that solder will do something we've probably all encountered but in a different context.  It has tarnished.  It's turned black just like grandma's old silverware, the kind actually made from silver.
Now, the silver content of any solder you're likely to be using is only a few percent at most, which is why the effect is so indistinct and mottled.  But that is tarnish, nothing else would cause that except maybe soot.  And I don't think the failure was quite spectacular enough to deposit soot.  And when you're depositing soot, you're going to deposit a lot of it.
Ok, bear with me.  You're still probably wondering what any of this has to due with the actual short.  The solder tarnished a little - so what?
If such corrosion is present, that means that there is sufficient humidity and ionic compounds (notably sulphates) present, probably left over from flux or a dozen other sources, to cause...
Electromigration
Oh yes.  If you thought you could safely assume that the metal on your board would, in fact, remain where you left it in the presence of a voltage gradient... of course it doesn't.  Nature would never miss a chance to make things even harder for us!
I kid, but electromigration is very real.  Tin, copper, lead, gold, those metals generally will stay put.  But not silver.  Silver is probably one of the metals most susceptible to electromigration.
What is electromigration, you ask?  Well, let's say you have a fairly steep voltage gradient, like the voltage differential we see between two adjacent drain pads, like between Q18 and Q19.  If silver is corroding, that means all the things needed for electromigration are present as well.  Put another way, if there is corrosion/tarnishing, then there will be electromigration if there is a sharp enough voltage gradient (which implies two exposed solder joints very close together as well, as any far apart would not have a high gradient).
There is almost certainly some flux residue left over, or if not that, we know there is some source of ionic contaminants because these AND humidity are needed for corrosion.  Whatever the source, it doesn't really matter - they're there, that's what matters.  They will cause silver to migrate, a lot like electroplating, and 'plate' onto the surface of where ever the voltage gradient is present.  In this case, those solder balls.  They'll plate and grow small, crystal/stalagmite type growths called dendrites.  The effect is small, and slow, but with time, these growths will build and lengthen with every operational hour, and after months and months.... they touch the other pad, and cause a short circuit. They'll grow over solder resist, or really anything, it doesn't matter.  And boom goes the MOSFET.
You'll even be able to confirm this if you get a sufficiently decent microscope and peek at those balls.  Nothing fancy, an optical one should be fine, but I doubt you'd be able to make out this fault with your naked eyes.
The other boards don't have any two pads in such close proximity because they don't have those little solder balls closing most of the gap, so they wouldn't have failed.  They may never fail, there might not be a high enough voltage gradient to support meaningful electromigration of silver.
Or maybe they will fail too, with enough humidity and time, it's hard to say really.  You can probably use a microscope to inspect them and see if there is any dendrite growth to be sure.
Regardless, your first instinct was always the correct course of action - you want to keep that humidity at bay.  Without humidity, there is no corrosion, and no solvent for the ionic compounds, and thus no electromigration.
Tweak the solder paste aperture of those drain pads, and additionally conformally coat those boards with a basic humidity blocker and if any more of the boards fail, it will be for different, new and exciting reasons and not because of a MOSFET pad shorting to its neighbor's.