Currently, failonfail defaults to true UNLESS any other options are passed in to the execute command (even if they do not modify failonfail). In this case, failonfail will switch to false. This is unexpected and should not happen. Failonfail should always be true unless explicitely set to false.
For this ticket, I think we want to create a new API with sane semantics. There's no telling how many modules/providers we'd break changing the current API.