HSBC is willing to pay 5 Mill to insure 100 Mill. It's just like an auto insurance policy, the probability of a person getting into an accident is about 0.189%, the probability of that person getting into an accident that would exceed 1 million in 3rd party liability is 0.035%. That's why if you want to increase your 3rd party liability from 1 million to 5 million would only be a difference of roughly 20$ a month. But most people would get that because it means they could walk away from any accident without resulting in any financial reprecussions.
In HSBC's case, even if all 100 of them defaulted (a very low probability but it's still probable), the bank wouldn't lose a single penny! This is also known as credit default swap or CDS which are just contracts between 2 parties.
Now CDO's are a little different, they are backed by collateral, in this case, real assests which includes subprime mortgages.
Lehman brother's failed because they were over leveraged almost over 40:1. They did not have a diversified portfolio like other investment banks, and only focused on selling CDOs. More importantly, they were too greedy. They were aware of the underlying inherent risks yet they ignored it. Unlike Goldman Sachs, Morgan Stanley and other investment banks, they did not properly hedge the risks involved with CDOs so when the market crashed, they crashed with it while the other investment banks made millions and millions.
One thing I would like to add is that all the rating agencies like S&P, Moody and Fitch are paid to by the big banks to give AAA ratings so they can sell them with a higher premium. There is a conflict of interest at stake.
The banks along with it's conglomerates and rating agencies conspired to rip off investors to line their own pockets. Greed is bad.