I agree -- a heater that can't recover on its own from a power cut is worse than worthless.
Personally, I use titanium elements on controllers (mostly Apexes, so there's a high and low temp alarm, too). You can use a glass analog heater as a heating element on a separate controller (I do this on my makeup water reservoirs because after enough time, anyone who uses analog heaters will accumulate a bin of them with glitchy thermostats), but the titanium elements eliminate the glass breakage risk.
Alternately, simply using two quality heaters that sum to a reasonable wattage to heat the tank is an option that helps avoid both overtemp (stuck 'on') issues as well as undertemp ( stuck 'off'), though they can be troublesome to dial in to play nicely with each other (often, only one of them takes all the heating load).