Sadly, it looks like those millions of man hours of incremental safety refinement also created a false sense of security. That (and management overriding engineering concerns) are the only explanations I have for how MCAS was implemented: because it had to be able to correct the pitch-up tendency of the 737 MAX and stay "invisible", so additional training could be avoided, Boeing apparently chose to use only one AOA sensor as "single source of truth" - because using both would have increased the chance of the system having to deactivate itself, which would probably have made the FAA mandate the additional training that Boeing wanted to avoid. This is just my personal theory however...