When it's spelled out like that, the idea seems preposterous. But the legal framework allowed it -- in certain contexts. AIG et al call them "CDOs" instead of just "insurance" so they could avoid the more-restrictive legal framework governing the insurance industry.
And given that a typical CDO is the size of a Manhattan phone book (remember those?), there obviously is a lot of nuance that a lot of people did not understand.