The real statement is "every unintended discharge on a known-safe gun is due to user error." I would believe that all unintended discharges on, say, a Glock 17 are user error. I no longer can believe that of Sigs.
And it's like brakes on a car. If it fails for even one person one time and causes one accident, that's too much. The stakes are way too high when you're dealing with something that can take lives if it malfunctions.
Before the sig the British Army used the browning 9mm which also had a safety
correct handling requires the use of a holster which completely covers the trigger. a properly-designed firearm is safe in a properly-designed holster.
the handgun that effectively established this concept (the glock) does not contain enough potential in the fire control at rest to discharge a round, but notably, the p320 does.