We are also trying to be very modular. We allow extra xaps to be downloaded based on the contract with the customer or different kinds of custom changes that they request. It seems like we would be setting ourselves up for failure if one of those "extra" modules had a bug in the constructor of the viewmodel so it wouldn't let us run the entire program.
It seems like the bug should only be an issue once you click on that item. That way if it was just some little test feature we were sending out to a customer it wouldn't bring down the whole system.
With the way the system is now any viewmodel that throws an exception in the constructor will shut down the system.
We install our software on a server on our customers site so this is not just SAS with one site to worry about.