Traders working in banks all knew that VaR was a pretty poor risk metric - at least definitely by 2007 and probably years before that.
Even the regulators "knew" that VaR did not cover everything.
I know this because I was building a CDO VaR Risk System for Royal Bank of Canada in which the regulator also required us to report the impact of "shock" scenarios because of the knowledge that VaR did not capture "tail risk".
It's not like people were completely stupid.
It's simply that while everybody knew about tail risk, they massively underestimated it.
Anybody who was anybody "knew" that a senior AAA rated tranch of a CDO was not a safe as US government debt no matter what that AAA S&P rating might say - but they probably didn't think that a AAA asset would ever be completely worthless either (i.e. every single name in the CDO would default, or that they would effectively have to "mark-to-market" it as worthless for the purposes of reserve requirements).
The real problem was that because they were rated AAA, regulators allowed their use as tier-1 capital (used to calculate the total amount of leverage the bank can take on).
Once it started having to be marked down at all, banks were forced to reduce their leverage to meet the regulator requirements, often by force-selling other assets, which in turn caused more mandatory mark-to-market write-downs, which cascaded into the financial crisis.
P.S. What saved RBC was simply that they were late into the CDO game and did not have a very large CDO exposure.