Faults in the field would probably be the number one cause of I/O module defects.
Beyond that...
For "hard contact" or relay output modules, I would say the number one cause of defects is the lack of surge suppression and/or the use of interposing relays. Usually, an installer will properly rate the modules against the loads, but may not always suppression inductive loads correctly. This can greatly increase the degradation of the module's contacts.
For input modules I would say that for normal wear and tear the input frequency is often a big factor. After that, shorts, spikes, and all in between are common reasons for them blowing.
For I/O in general, and depending on the platform, the chassis, or backplane should also be considered. Leaving spare slots uncovered is a very common practice and can allow dust and critters easy access to its circuitry.
If you have several output modules, of a particular brand/model going faulty on a regular basis, then I would first look to the loads they switch and whether they have or require interposing relays and the loads themselves, whether they have or require surge suppression.
It's good practice to just do it by default if switching noisy inductive loads.
Regards,
George