That would be I guess a low probability high impact event- not likely to happen, but when it does the risk to life is high.I don't really have a good answer for that question. There must have been a reason when the code required the separate branches rather than allowing everything on one ATS.
Regardless, with all of the testing of the essential electrical system that is required, I would imagine that simultaneous failures of the utility and an ATS would be rather rare. I think that we in the industry spend so much time thinking about how to mitigate problems that we tend to overestimate the likelihood of the problems occurring. Arc flash events are rare events when you consider how much electrical equipment there is installed, but yet we spend much time and effort trying to mitigate the danger of an arc flash that I am sure I would greatly overestimate the likelihood of an arc flash occurring.
Hopefully someone on here knows why code made the change.