I don't know the MTU ECM's at all, but likely they are similar to most of the other larger diesel engine ECM's.
Most sensors operate on lower voltages than the input power. On one particular ECM I am most familiar with the input power is 24 VDC, the ECM has power outputs for 15, 12, 8 and 5 volts DC. Some ECM's use a single return or common for all power supplies, some use independent or isolated returns. Some returns are monitored for current to determine diagnostics from abnormal conditions, so lots of things going on in an ECM.
So you have an ECM with a "short circuit" internally. If you really want to determine the root cause you would have to figure out exactly which circuit is failed, then you work back from there to determine likely causes and run those down to determine a best possible root cause. Unfortunately most manufacturers don't provide internal ECM details, so making a good failure analysis can be hard.
Since it ran an additional 65 hours since the sensor failure you described, while it may be a possible problem, in reality, probably not. If it had been the probable contributor the ECM failure would have likely shown up soon after the repair.
Things like welding and lightening strikes can sometimes show up in strange ways, most common is some kind of corruption of the program files or base firmware, and damage to things like memory and processors.
Here is a good general guideline from the trucking industry that is in line with the EMA's and most engine manufacturers recommendations in regards to welding on any units with electronic controls,
My own experience is that power supply problems are the biggest killers of ECM's, battery chargers, jump starting with weld machines, bad grounding, failed/failing alternators, bad power connections and bad batteries are all some of the things I have found over the years in connection with "dead" ECM's.
As for the E-Stop, I will guess the unit has a programmed cooldown timer and the operator doesn't want to wait until it cycles down to finish the test run, so he punches the E-Stop, resets it when the engine dies and walks away. You might want to fix that issue, otherwise you can end up having some other problems related to the engine. I doubt the large number of E-Stops have any relation to the ECM fault unless you have added solenoid valves in the fuel or inlet air system (like Rigsavers)that draw more current than the circuit they are connected to and not protected for flyback or spikes. I did have a unit about two years ago the Fire Marshall insisted on an Auxiliary Fuel block valve that would close whenever the E-Stop was pushed, contractor wired it in without really checking with the dealer on how it should be installed, after the third "test", the E-Stop would not reset, failed the ECM input for the E-Stop. It was a big solenoid valve on a small circuit not ever designed for the current draw or the voltage spike when the coil was de-energized, but the end user wanted warranty on the ECM anyway (no, he didn't get it).
If you have field added components or circuits, make sure they are within the design capabilities of the engine control system, if you have a pretty simple package then probably not an issue.
Hope that helps, MikeL.
