thanks for your question.
This is true and even necessary if there is no cluster partition. The task subscription only guarantees that a task is seen at least once. There are different situations which can lead to a task being processed twice by workers, for example if the worker exceeds the lock time of the task, then the task can be handed out to a second worker. Or if the client cannot reach the broker to mark the task as completed, so again the lock time exceeds. Even tough only one client will be able to complete the task it is possible that more then one client receives the task.
I think this scenario would not lead to a task been pushed to two workers. Before a task is pushed to a worker it is locked and this lock event is written to the log. Only when the lock event is committed the task will be pushed to the worker. A leader without a quorum of followers cannot commit this lock event, therefore will not push the task to the worker.
In general all state changes have to be committed to the log before a client will see this state change. This also means if a cluster loses a quorum of followers the cluster is not available anymore in a sense that it will not accept any further state changes until a quorum of followers is available again. This also amplifies your point that a task worker should be idempotent, as it may not able to complete a task on an unavailable cluster.