When they combine a number of risky assets into a single asset, they factor in an assumption that a number of these will fail. Others will not and given the payoff of those, the net investment pays off.
I don't know much about finance and how they do these calculations, so I'm going to say something dumb here, and maybe someone can tell me if they are being this dumb (or dishonest) when the calculate these things. Forgive the "explain it like I am 5" description.
There is a naive way of combining these probabilities which high school students probably know. However, this assumes the outcomes in question are not correlated. For example if you flip two coins, the probability of each coming up heads is .5 and they are not correlated, so the probability of getting two heads on two coin tosses is .25.
Of course, if the events are correlated, then that formula doesn't work any more. For example, if there is a new Quantum Coin Toss Manipulator (because we all know it would have to be quantum) that makes all coins flips near it come up the same, then the probability of getting 2 heads when you do two coin tosses is no longer .25 but instead it is .5. And, if you do 100 coin tosses, the probability is still .5 of getting all heads.
Back to the CDOs or CLOs. The chance of individual components failing is clearly not completely independent. Economic conditions such as a big recession presumably will have similar effects on the different components. So the naive formula does not apply.
Hopefully they are not being that naive or dishonest, but it seems like it would be pretty tricky to estimate the correlation and correspondingly difficult to estimate the true risk. Is it that case that they are just not good at estimating the correlation in the risks of these different assets?