To be clear, I'm not trying to gotcha you here. It's just that I have seen multiple people report situations with the explicit expectation to be safe against respawns above shaky, both for scenarios that were intended and those that weren't.
It's not as simple, in any case. First of all, the game determines all cities that can potentially flip. Those are usually those inside their respawn area (sometimes not coextensive with its core), but if it's from a collapse it is limited to the cities owned by the collapsing civilisation. Then, a rule is applied that comes closest to this belief: if you are unstable or worse, the AI will get all of those cities. If you are shaky, the AI will get the city that will become its capital, cities that are in the core of the respawning civ and not in the core of the owning civ, or cities that are colonies of the owning civ. If you are stable, the AI will still get the city that will become its capital only.
Another factor is that before anyone has discovered Nationalism, all those thresholds are lowered by one, so you are safer against respawns. Conversely, respawns that involve only AIs have those thresholds reduced by one, to make the world more dynamic.
This is not the final outcome, however. A respawn can still fail at this stage. If only succeeds if it includes at least two cities, OR all cities that are available to flip (i.e. if only one is possible, one is enough). But, once a civ has cleared this threshold, it will receive all other cities in the respawn area if it is able to flip all but two of them, regardless of the above limitations. This is mostly to avoid cultural bordergore and messy situations where the respawning civ has been controlled by multiple other civilisations. But it can mean that another civ that is nearby and susceptible to a respawn can wind up sweeping some cities you control into the respawn, even if they themselves would otherwise be safe.
So, it's a lot more complicated than a simple stability gate. Why is it that complicated? Experience has shown that respawns need some leeway to be successful, or otherwise they end up being semi-dead, nonfunctioning civs instead, which is not desirable.
The flipside is that the conditions are harder to understand. I see the appeal for an easily communicated catch-all condition, because you would be sure about whether you are safe, or not.
But first of all I would like to make sure that it's not the game documentation itself that reinforces this misconception. Might just be an urban legend that is reinforced on the forums instead, though. Still, not sure how to make this more transparent. Maybe it needs to be communicated more clearly after the fact at least? Maybe the messages should be "China has declared independence from your empire!" and "China has declared independence from the Mongol empire!" etc. to make clear who the weak link was, followed by "Your cities of X, Y, Z have joined China in their independence from Mongolia!" or something. That at least would make it clear that it's Mongol instability that caused this.
I do plan to give a bit more leeway to contesting these city flips, in the same way you can for initial city flips, when I rewrite civ spawns in the Rise and Fall rewrite, by making them share much of the same code and rules. That should make the whole thing less frustrating, regardless.
(I haven't actually looked into this particular case yet, though.)