But the odds of both pilots failing on the same flight must be better than that. And just because a test failed, doesn't mean there was actually a grounding condition that got missed. Even if you have a grounding condition, and it got missed, doesn't mean you'll stroke out in flight. If you do, the other guy will just land asap. Layered defense.

I can only think of two instances in modern 121 where both pilots were incap. One involved loss of pressurization (not in the US), the other involved guys wearing turbans. Neither were caused by pilot medical issues.

10^-9 is the safety factor for the entire enterprise combined... hardware, software, pilots, ATC, external nav systems, etc.

IIRC that's the allowable threshold for fatal accidents in 121. The UAM folks wanted to use a threshold that was a couple orders of magnitude less.