Isn't engineering a giant risk management excercise?

Yes. For everything (planes, trains, and automobiles) there will be some combination of failures where if it occurs everyone dies. The trick is to make that so unlikely to occur that you'd have to really fuck up for that to have happened. Which is why, when you read something like a plane crash report, it's never one thing that goes wrong but a combination of things (which sometimes occur over years) that leads to disaster.

There are very specific processes people use to assess risk in a formal way, but they aren't really taught in school. And even when you know how to do it there's a fair amount of subjectivity involved unless there are objective regulatory requirements you have to meet (in which case you don't want to ask how the "objective" regulatory requirements were determined any more than you would want to ask how the sausage you're eating was made).