The pack is designed such that a cell failure won't propagate.
I'm not sure this is true. The cells are individually fused so an overloaded cell will be protected to avoid runaway, and the pack has features to help prevent runaway from occurring.. or doing so too quickly.
But I don't know of anything that would prevent a defective (or otherwise compromised) cell that ended up in flames from spreading to the adjacent cells in the module. They are all packed together, and once you get 444 cells on one module burning, the others will go as well, albeit the dividers in the pack may slow that avalanche some.
Tesla does have a patent for using an intumescent coating on individual that would act as a fire retardant, but it appears to not be in use within the current packs (or at least the earlier ones torn down and examined).
If it wasn't road debris, my guess would be a short in the DC/DC converter. A short could make the main contactors break the current, which is known to be described as a pop or bang by those who experience it. And a fault there could engulf the front of the car in flames fairly quickly.
This would be interesting. The one known pack puncture actually did so on the front face of the pack (I.e. on the side of the "hump" at the front of the pack), and not through the ballistic armor bottom plate. Subsequently cars are built with protection to avoid that same accident... similar to the titanium retrofit made available to existing cars.
The other mechanically-induced fires have been accidents severe enough to compromise the integrity of the pack.. .in one case actually ripping the car in half.
If this was a case of debris, I'd be interested in understanding how/where it would have managed to puncture the pack.
I suspect electrical fault is more likely... contactor failure within the pack, or HVJB short of some sort, as apparently was the case with the Norwegian car fire...