Why do tantalum capacitor datasheets only quote endurance at their max temperature? How does it change at room temperature?
How do I derate for a lower temperature? For example, at 55 °C I
  imagine the lifetime is more reasonable, but I can't find any
  resources on this. Is there any way to know? Is it a crapshoot?


If the manufacturer doesn't provide the information then you could test it yourself or email the manufacturer and see if they could provide more info. There are two reasons why they didn't:  


One is the lifetime for a cap at room temperature is significantly longer than a high temperature capacitor and the testing time becomes prohibitively long.    
The second reason is the degradation happens faster at high temperatures so they provide the spec at the high temperatures to provide and upper bound and to show that the lifetime will be degraded if you run them at +50C. 


Another thing to note is a manufacturer can never provide an exact time of failure only a mean time between failure (MBTF), so if your application is critical, testing and buying high reliability parts will be necessary   

I've never had a problem with tantalum capacitors running in products at 40C for years. And the specifications probably degrade slightly from the original specs, but in my application I use them as power filter capacitors and my design is tolerant to slight degradation of a few percents. 


  If so, isn't designing with tantalum caps incredibly risky in
  something that expects to be used on the order of years? How do you
  deal with this conundrum?


1) Don't use the capacitors for applications that are dependent on the capacitors value.
2) Don't run them at high temperature.
3) Use the right kind of tanalum capacitor, the electrolyte makes the difference.  

4) Know what the faiure modes are and mitigate them:


  The life time, service life, load life or useful life of tantalum
  electrolytic capacitors depends entirely on the electrolyte used:
  
  
  Those using liquid electrolytes do not have a life time specification. (When hermetically sealed)
  Those using manganese dioxide electrolytes do not have a life time specification.
  Those using polymer electrolytes do have a life time specification.
  
  
  The polymer electrolyte have a small deterioration of conductivity by
  a thermal degradation mechanism of the conductive polymer. The
  electrical conductivity decreased, as a function of time, in agreement
  with a granular metal type structure, in which aging is due to the
  shrinking of the conductive polymer grains.[62] The life time of
  polymer electrolytic capacitors is specified in similar terms to the
  non-solid electrolytic caps, but its life time calculation follows
  other rules which lead to much longer operational life times.
  
  The extremely thin oxide film of a tantalum electrolytic capacitor,
  the dielectric layer, must be formed in an amorphous structure.
  Changing the amorphous structure into a crystallized structure is
  reported to increase the conductivity by 1000 times, combined with an
  enlargement of the oxide volume.[12] The field crystallization
  followed by a dielectric breakdown is characterized by a sudden rise
  in leakage current within a few milliseconds, from nanoamp magnitude
  to amp magnitude in low-impedance circuits. Increasing current flow
  can accelerate in an "avalanche effect" and rapidly spread through the
  metal/oxide. This can result in various degrees of destruction from
  rather small, burned areas on the oxide to zigzag burned streaks
  covering large areas of the pellet or complete oxidation of the
  metal.[7] If the current source is unlimited a field crystallization
  may cause a capacitor short circuit. In this circumstance, the failure
  can be catastrophic if there is nothing to limit the available
  current, as the series resistance of the capacitor can become very
  low. If the current is limited in tantalum electrolytic capacitors
  with solid MnO2 electrolyte, a self-healing process can take place,
  reducing MnO2 into insulating Mn2O3
  
  Impurities, tiny mechanical damages, or imperfections in the
  dielectric can affect the structure, changing it from amorphous to
  crystalline structure and thus lowering the dielectric strength. The
  purity of the tantalum powder is one of the most important parameters
  for defining its risk of crystallization. Since the mid-1980s,
  manufactured tantalum powders have exhibited an increase in purity.
  
  Surge currents after soldering-induced stresses may start
  crystallization, leading to insulation breakdown.[69] The only way to
  avoid catastrophic failures is to limit the current which can flow
  from the source in order to reduce the breakdown to a limited area.
  Current flowing through the crystallized area causes heating in the
  manganese dioxide cathode near the fault. At increased temperatures a
  chemical reaction then reduces the surrounding conductive manganese
  dioxide to the insulating manganese(III) oxide (Mn2O3) and insulates
  the crystallized oxide in the tantalum oxide layer, stopping local
  current flow.[7][66] Failure avoidance
  
  Solid tantalum capacitors with crystallization are most likely to fail
  at power-on.[70] It is believed that the voltage across the dielectric
  layer is the trigger mechanism for the breakdown and that the
  switch-on current pushes the collapse to a catastrophic failure. To
  prevent such sudden failures, manufacturers recommend:[12][66][71]

50% application voltage derating against rated voltage
using a series resistance of 3 Ω/V or
using of circuits with slow power-up modes (soft-start circuits).

  
  Source Wikipedia Tantalum Capacitors