In all fairness this plane is only a danger to its crew (and to regular commuters). Even without the software fix, the probability that you get into a crash in one of the few times in a year when you make a leg in this plane is still infinitesimal. For the crew that spends the whole year in there, different story.
By my calculation the plane was flying roundabout 100.000 days with 2 accidents. Assuming 2 round-trips a day maybe 200.000 takeoff during this time. One crash every 100.000 take-offs.
Now assuming 40.000 road deaths per year in the US and 300.000.000 citizens we have 0.000133 probability to suffer a road death a year. Assuming one 737MAX round trip per quarter we have 8 take-offs so .00008 probability to die in a 737MAX. Assuming commuter 40 trips a year we have a risk much higher than the average road death risk.
I assume that AoA sensor disagree would have been warned about still on the ground. Even if both fail, a new take off checklist will probably include comparing AoA information with analog instruments. If one sensor failure is 10E-5, two simultaneous should be 10E-10, multiplied with assumption of competence (say 99/100 will now know how to deal with it), which gives 10E-11 - 10E-12. I.e. I wouldn't worry about MCAS anymore after every plane has been updated.
What I would worry about is departure stalls, as MCAS doesn't seem to solve these. I wonder whether there isn't another 10E-5 to 10E-6 risk in there and people have just been lucky so far. Another MAX8 crash involving a stall would kill this plane I think, as it would prove much more that it's inherently unsafe.
From the FDR data in the report, it seems that the AoA sensor disagreements on this flight didn't start until after takeoff. I don't know if this is the normal failure mode.
