They do have more than 3 AZs. Our account has access to 5 distinct zones and I suspect there are more than that.

Capacity dedicated to failover is not spare, when you've sold failover capability to your customers.

I doubt they have quite that much spare capacity in any AZ. In the past (2012) they seemed to be capacity constrained when a whole AZ went offline. In a situation like that, some customers would move to a different AZ quickly, and others would just wait it out. Spot Instance pricing would also jump quickly, which would free up some capacity when low-budget workloads shut down.