The studs have been changed so the aircraft is safe and even happening twice it will be 'etremely remote' across the entire life of the type, so that is ok. Remember in one case every survived and that is down to the RFM.
SM, I disagree with your above rather bold statement. Here's my reasoning:
Extremely remote = 10 ^7 to 10 ^9 per flight hour, so how many flight hours does the S92a have to allow 2 failures and still be in compliance with FAR 29.927 (c)(1)? I would calculate at least 10^14 hours required, so IMO the type approval is not valid and wasn't after March 12, 2009.
IMO the wording of FAR 29.927 (c)(1) is too loose and ambiguous, as a minimum "loss" should be changed to "loss and/or total loss".
So how did SAC prove to the FAA that this type approval is still valid by changing out the titanium studs to steel, did they know the true cause of the low cycle fatigue and prove that this root cause was removed by using steel instead of titanium? Broome was apparently blamed on over-torquing of the stubs, 491 still has the TSB report to be issued, so for me the jury is still out on that one.
Who is not to say that there will be another as yet unknown failure path with the current S92 MRGB, as with all rotating and mechanical wearing parts there is always the unknown to deal with albeit planned maintenance routines are put in place in an attempt to provide adequate management to prevent catastrophic failure events. We can only rely on the designers to capture all aspects/scenarios as with all other AC types.
Safe flying
Max