It has to do with the classification during the system safety analysis (SSA). IIRC, the MCAS was classified as 'hazardous' if failed but not 'catastrophic'. If it were classified as a higher hazard level, it presumably would levy additional requirements. It's a risk-based approach, which sounds like they failed to appropriately classify the risk.

https://www.seattletimes.com/business/boeing-aerospace/faile...