Why not more Max 8 accidents?
With a well functioning angle of attack sensor the 737 MAX was safe. Only a malfunction which let the sensor report a higher angle than real would result in the repeated attempt of the MCAS to trim the airplane nose down.
Such a malfunction is a rare event (10 per year across all types flying in the US). This should explain the many uneventful 737 flights. However, to rely on only one sensor was criminally negligent. A safe design would have redundancy built in. Ironically, the 737 MAX has such a second sensor (just opposite of the one which fed the MCAS) but the software did not crosscheck the readings.

Additional remarks
Now there have been so many comments, and they all have been caused by my rather cursory description of the problem, that I better expand this answer so people will not feel a need to add more comments.
MCAS was already introduced with the Boeing 707 and the KC-46 (tanker version of the 767), but would only add nose-down trim once if a prescribed angle of attack is exceeded.
With the more powerful LEAP engines of the 737 MAX, pitch stability at high angle of attack and high thrust would become negative, something that would make any airplane immediately impossible to certify under current regulations for civil aircraft. The more forward position of the intakes and the high suction on the intake at high angle of attack would had required a larger horizontal tail if proper design rules would had been applied.
But Boeing is run by ex-McDonnell-Douglas management where cost-cutting is more important than applying proper design rules. A larger horizontal tail would result in structural changes throughout the rear part of the airplane, require new jigs and tests and a much more complex certification. Simpler solutions did not work out, either: Several aerodynamic solutions were introduced such as revising the leading edge stall strip and modifying the leading edge vortilons but they were insufficient to pass regulation. So the instability had to be fixed in software.
The result was a system that read inputs from a single sensor, and under the right conditions (flaps up and autopilot disengaged) changed pitch nose-down by 2.5 degrees stabilizer rotation when a specified angle of attack was exceeded and repeated this mindlessly after five seconds if the angle of attack was still too high. No provisions had been made for a defective sensor. Concerns by engineers and test pilots about the hazards resulting from a sensor failure were ultimately dismissed. Eventually, Boeing officially assumed that pilots would respond to an unexpected MCAS activation as if it were a runaway stabilizer trim event, and do so within four seconds.
All 737s have two AoA sensors, but the MAX MCAS relied on only one sensor at a time, switching between the left and right one each flight. By the way, the KC-46 MCAS, although less powerful, uses the inputs of two sensors and trims the stabilizer by just 0.6°, and only once per activation.
Next, in order to limit the amount of pilot training for the new type to Level B (no simulator), the MAX should feel to the pilot like a next generation 737. This made it possible to fly the MAX with the type rating for a regular 737, a big selling argument to airlines which already operated the 737. MCAS helped to achieve this, and information about its details was not part of mandatory training (which consisted of a two hour iPad tutorial). By repeating the pitch trim change, the MCAS had become safety critical where earlier versions were not. Nevertheless, information about it was hidden and most pilots did not even know of its existence after their transition to the MAX.
Another factor was the insufficient funding and regulatory capture of the FAA in the last decades which had less personnel to check new designs, so it gladly handed much of the testing for certification to the manufacturers: Boeing Authorized Representatives are Boeing employees who are granted special permission to represent the interests of the FAA and to act on the FAA’s behalf in validating aircraft systems and designs’ compliance with FAA requirements. The core function of the certification process, to let a second pair of trained eyes look over the new stuff, was outsourced to the same people who had authorized those designs. Also, the capacity of MCAS was misrepresented to the FAA as an addition to speed trim in order to avoid more scrutiny and testing. Later investigations found a disturbing trend of FAA management treating operators favorably and overruling the work of technical experts.
As usual, several opportunities to avoid what happened were missed and several causes conspired to make MCAS the trap it became.