Maybe I misunderstand something now. How could Nimrod be ALARP with a time line? Surely it is either ALARP or it isn't?
HC makes reference to how the temporal (time) aspect of R (i.e. reasonable) in ALARP is widely misunderstood (but highlights how QinetiQ should know better). I.e. it is reasonable for it to take time to embody safety design changes, depending on the residual risk. TWA800 is a case in point where airworthiness directives gave Airlines years to modify their aircraft - on the basis that to ground all the worlds airliners until they were all modified was unreasonable in proportion to the risk. Obviously if the residual risk is such that another loss is not remote, then you do ground the fleet (e.g. Buccaneer - 1980 - most of the fleet 6 months on ground).
Furthermore, your argument about seals and the fact that all aircraft suffer fuel leaks was dealt with by H-C, he was unimpressed.
Doing all you can to avoid leaks is the design aim - but from an engineering perspective you can't make the probability of a fuel leak so remote that you don't have to mitigate (i.e. design) against their occurance. You can't be sure an aircraft won't leak - but you need to be confident as you can be that such a single failure won't cause the loss of the aircraft. HC does comment (p66) that this is a common philosophy across civil and mil. His main criticism is that he feels that (perhaps due to this this philosophy) there had been complacency in the management of fuel leak trends etc. - i.e. more could have been done to understand & reduce fuel leak risks. I wouldn't dispute this. I don't think he says you can eliminate fuel leaks altogether.