Also: A organization can have foggier responsibility structures than "the boss says $X which is why $X is done".

E.g. you could have a boss who says safety is truly important and even does a ton to help with that, while lower management is so obsessed with other metrics that they sabotage that on a conscious or subconscious level while emulating compliance to their higher ups.

This is very common.

The "evil boss"-scenario is the simple one where it should be very clear that Joe is not to blame. This is precisely why it is important to also look at less clear ones where it would be easy to blame the accident on individual human error — instead of finding the actual root causes.