The biggest reason why this "stuff" was rated AAA was that banks backed them fully, ie if they defaulted then the bank would step in and make the investors whole again. Hence the CMO's got the rating of the bank that provided them.
The thinking was that some mortgages would go bad but certainly not a large percentage of them.
Unfortunately, not quite. Our laws regarding these things are very primitive, which often means that you can be in perfect legal compliance, yet still commit some very severe fraud against the people you're making offerings to.
I find it rather unlikely that our regulatory system will ever catch up with the state of the art in finance. There's too much money to be made in the short term by shoveling risk off into the cracks and pretending on paper that it doesn't exist, and it's too easy to do.