Triple Modular Redundancy w/ Majority Voting when a microcontroller fails
The general assumption in safety and redundantly designed systems is that only one failure occurs. 

Generally, it is assumed (and designed) that failures are independent, so a single failure doesn't trigger additional failures (cascade of failures). For instance, if a circuit overheats, a thermal protection trips, rather than having that circuit's heat cause another circuit to fail etc.

In a redundant system as described, you have to assume that only a single failure occurs -- this means that you have to ensure (through the physical design, wiring etc.) that for instance A and B can't short together, or Q shorts to A etc.

The general failure assumption is that the MCU's pin doesn't fail high Z, but fails to an incorrect logic state. In case of high Z, a passive pull-down R on the outputs (perhaps implemented in the majority gate) might also be used. Note that in the redundant system, a high Z won't be any worse than a stuck-at state.