this notion of pricing risk appears rational, or even mathematical, and indeed the whole insurance industry depends on the concept, which originates in the probability theory/inductive logic of people like pascal. but the question is beset by innumerable difficulties. it's not at all clear that by any standard the risks were underestimated, even in a situation wherein we see the risks realized. first of all, the traditional way to generate the relevant probabilities is in terms of past frequencies. but though, say, the collapse of securities has happened before, both the securities themselves and the context in which they collapsed had been radically transformed: the analogies under which the frequencies are delineated are extraordinarily complex and subtle. in some ways, each moment of climate or financial history is similar to all the others and more similar to some of them than others, in myriad or indefinitely many respects. in other ways, each event is incomparable. the current problems are in a billion ways similar to 1929 or whatever, in a billion ways entirely different. actually pricing the risk of some new security or credit default swap is beyond complex: it is in principle impossible, more or less, especially because the swap itself is a pricing of risk, thus involving you in an infinite regress.
so let's say your reference-class in assessing the risks of some security is the performance of similar securities in the past. then you'll price the risk very low until the collapse, very high afterward, and that is roughly as good as you can do, if you are required to proceed in this manner. of course the risks were underpriced twenty minutes before the collapse by the standards of twenty minutes after the collapse. on the other hand, if you're speculating that there may be a collapse given a new set of circumstances, then previous performance might be largely irrelevant or actually (pace more or less all inductive logic) counter-predictive. the better the previous performance in some sense the higher the risk: that's what we call a bubble.
say you're a health insurer. it might seem that you're pricing risk well as you rake a small profit consistently. until the unexpected epidemic: then the models all collapse. insurance always works within this paradox: it ticks along, then collapses all at once when the hundred-year hurricane comes.
well, the frequency theory of probability, according to which the probability of an event is fixed within a certain range by the frequency of similar events in the past is only one approach, and has to some extent been superseded by computer-modeling. but the models themselves are, of course, derived from information deriving from the past and present. what is the chance of some unique or incomparable event happening at the level of a global ecosystem? i'm not sure this is even a well-formed question.
yet another approach is to use bundled knowledge or intuition: to make betting behavior of large groups (or "the market") a measure of risk. it goes without saying that this is trivially anti-productive in the case of stocks etc, or else there would be no bubbles and busts.
now that we're under risk is not in question. but that risks in situations of extreme complexity can be rationally priced at all is certainly a question, not a fact on which to ground a critique or make policy. this problem infects what friedman rather cavalierly calls "wise regulation": it was not at all clear what sort of regulation would have been wise with regard to credit default swaps before the collapse; they had established a long-term record of steadiness and profitability; indeed they appeared to be forms of insurance against risk rather than forms of risk.
i think in some ways the intuitions of informed persons are probably better than mathematical models, that your best chance with credit default swaps was someone who'd been thinking about it saying: smells funny. but that's a hard way to defend an expensive regulatory regime. and of course those intuitions are based on things like frequency, perversity, social consensus, personality of the intuiter etc.
we live, as it were, by trying to eradicate risk, though we also court it, and both are perhaps adaptive and counter-adaptive. but i'll tell you this: at the level of driving to work or the level of infinitely complex economies, we're never going to be without it, and ultimately would not want to be. if it could be accurately "priced" it would no longer be risk.
but my main point is just this: by definition, induction or probability-as-frequency does not brace you for the crisis and does not provide you with a reasonable assessment in its aftermath.