If the pin carrier had been designed to contain a simple bearing allowing rotation of the at the control end of the shaft, instead of clamping it, the nut would not have come undone.
Well yes, but the idea was that the duplex bearing took care of this. So a second bearing would only be relevant when the main duplex bearing had failed - I guess it never occurred to anyone this could happen. That second bearing would have to be pretty beefy given what it is handling, and could itself be a source of failure. Also, as I understand it, once the duplex bearing failed, the insides of the servo are spinning in a way they were never designed for, so even with the second bearing something was going to go very wrong very quickly.
Many thanks to nodrama for the explanations here - without the pictures it's very hard to understand what is going on here. Have been lurking here since the beginning, with increasing horror.