Also, it's incorrect to say that we could have used decades of problem-free operation to extrapolate and predict a low risk of similar accidents in the coming decades. The 2009 crash was caused by an aging system, and unless your solution involved replacing all the switches/sensors, we would have seen new failures at a more frequent rate.
Finally, the 2009 accident highlighted an inherent problem with the old system: putting a human operator in a train who is only responsible for acting in an emergency will not work. Just like the recent self-driving car fatality. It wasn't a case where we knew and should have accepted the risk, it was a case where the crash caused us to understand that the prior risk assessment was wrong (because it assumed that a human operator could prevent these kinds of accidents, when that's just not going to happen). So it was appropriate to change operations.