I used to work in commercial aircraft certification. Boeing and other manufacturers typically have their own in house ODA (basically a certifying body that is overseen by the FAA). The ODA is given power to approve certain things by the FAA, this is done because the FAA isn't big enough to review every aircraft engineering decision and regulation. The FAA regulations are written in blood, it is a set of reactionary rules, so if it hasn't been directly involved in a crash yet it is unregulated. Boeing only makes money when they sell planes, so there is corporate pressure to approve things that might be on the edge of the regulation requirement. Also it takes years to develop a new plane. The Max line was 100% a cost saving decision. Instead of designing and certifying a new frame they only had to certify the new engines and engine mounts.