See the definition of what makes up a Service Disconnect in 230.71: The service disconnecting means for each service permitted by 230.2, or for each set of service entrance conductors permitted by 230.40, Exception Nos. 1, 3, 4, or 5, shall consist of not more than six switches or sets of circuit breakers, or a combination of not more than six switches and sets of circuit breakers, mounted in a single enclosure, in a group of separate enclosures, or in or on a switchboard. There shall be not more than six sets of disconnects per service grouped in any one location.
So panel 1 and 2 are both the "service disconnect". N-G bonds can, and generally do, occur in both. This is due to the fact that the NEC can't force the power company to bring separate neutral and grounding conductors to your Service. The grouping of the Service Equipment and the fact there there are generally multiple grounded connections between the enclosures (conduits, GEC tails) helps to minimize the risks.
250.142(a) applies to the "Service Disconnect" which in this case is a group of enclosures.
Certainly, you could implement this with a single disconnect enclosure and isolate everything down stream, or put a jumbo neutral bar in one disconnect and isolate the neutral in the others while including a separate EGC. But the code doesn't require that, and it is usually cheaper to have multiple lower amp disconnects than to have one large one.
I don't see the hazards described as being "very important" to mitigate. 3 wire feeders to outbuildings were allowed for decades with few problems. A spark from a loose grounding connection isn't generally hazardous unless in a Classified environment (although you could argue that if natural gas appliances are present that is a hazard). If the neutral has totally come loose, you get some obvious warning signs for that. And many of these "hazards" still exist at all building services because fo what the utility provides.
