The key is that if a separate grounding conductor is used, it takes a
double-point failure (the ground has to be open AND a hot lead has to contact
the chassis) in order to create a life-threatening situation. Using neutral
as ground, all it takes is a single-point failure (floating neutral) to produce
a threat to life.