The initial iteration is that they pool a bunch of loans together to aggregate the risk. They know from history (short term history - a vulnerability that turned into a failure mode) that mortgage defaults are quite unlikely to happen in the first, say 5, years, so they can sell paper that matures in 5 years and be confident that it has a low failure rate from the (flawed) historical perspective. The longer term paper on the loans will historically have a higher probability of failure, so the longer term paper has lower ratings.

Then the recursion occurs.

1) Homeowners kept refinancing their houses (encouraged by the insatiable appetite for new mortgages to slice and dice into AAA-rated paper), so their loans never aged, they just kept getting reset.

2) The bankers took the remaining less-than-AAA-rated aggregated debt and used to create a new debt vehicle and then claimed all over again that the "new" debt (which was really old debt reheated) could be re-sliced into AAA-rated debt plus residual lower rated debt.

This quickly turns into a house of cards which inevitably failed when short term history (low failure rates based on long held mortgages and "perpetually" increasing house values) failed to model reality.

E.g. U.S. Government debt is currently AAA rated. But all bonds and treasuries are highly correlated: in five years either 0% or 100% of US Gov debt will still be AAA.

There is some argument to be made that an awful lot of sophisticated investors didn't recognise before the crash that there was such a high level of correlation, so to some extent we're talking with the benefit of hindsight at this point. With hindsight it seems obvious that these bonds were doomed, but without the benefit of what we now know, how much should the ratings agencies be blamed for not recognising the risks?