The problem in 2008 wasn't really MBS it was the way they were packaged.
You take a collection of n mortgages and rank them by how likely they are to default, and then you divide them up into say 5 different securities each containing n/5 mortgages. The top 20% will be considered the least risky and the bottom 20% the most risky, and yields will reflect that. There are also rules on what risk level different asset managers are allowed to take on, so random retirement accounts wouldn't take the bottom 20%. No problem yet.
But then some "spherical cow" style math was applied to these things. If mortgage defaults are independent events then mathematically you can smooth out the risk even from the high risk ones by just grouping a bigger number together. So they took say 5 different shit tier mortgage collections, lumped those mortgages together to create another pool of size n, and repeated the process. Now the top 20% of that pool was given a very low risk rating, yet it still paid a greater yield than the original pool's top 20%, so why wouldn't an investor want to get in on this high yield safely rated security?
And it didn't stop from there, the bottom say 20% of those pools were again pooled together to create more supposedly safer securities.
This could've held up for a long time in a vacuum, as long as mortgage default rates didn't change too much. But part of what incentivized this system in the first place (and in turn what this system incentivized) was to hand out mortgages like candy basically.
So it was a house of cards waiting to fall, and once some of these securities faltered it also caused a bank run on a wider set of MBS structures that probably could've held out if not for the panic. Plus big failures like Lehman Brothers and Bear Stearns had impacts on firms that went beyond MBS activity, so there were some crazy cascade effects too.
Anyway, there's nothing inherently wrong with MBS, it's just important to know what you're buying. This situation is weird because it's not that the security itself is unsafe, it's the context in which they are using it that is risky. Though I suppose it relates on the high level that they probably thought "this security is rated very safe and it gives relatively high yield" without an actual understanding of the risk involved in their use case.
