I have been thinking about these two suggested limits and think there will be some difficulty in reaching them both. While the scan rate measurement is somewhat separated from the response time, they are still intertwined. Consider the 10 Hz full scale scan rate minimum. 10 Hz has a period of 100ms, during which there are a trough and a peak of the sine wave where the scan speed is slow, slower than the maximum deflection speed in a 5 hz scan rate. These periods last at least 25 msec. So, on one hand a 10Hz cutoff could be reached with low pass filtering of the absolute value of the velocity, but the filtering response time would have to be slower than 10ms. On the other hand, we could keep the 1 or 10msec response time, but at a cost of blanking the edges of deflection of the 10 Hz scan. This is all only considering one channel, where if it were a line it's likely the edges of the 10 Hz scan WOULD be unsafe after all.
Now if we consider both axes, and if we are generating a 10 Hz circle then at any given time one of the axes is generating the velocity required to keep the scan safe. Thus, the summation of the absolute value of the scan velocity of the two axes (as in the above circuit) can achieve the 10 ms or less response time while not blanking in 'safe' scanning situations such as a 10 Hz circle, but it wil blank if one of the scanners fails. This is another reason why, if single axes checks are to be implemented separately as above (in addition to the dual axis check), their response time needs to be slower than the response time of the sum of the deflection velocities.
What does this mean for safety? It means that the system above will allow a lower safe minimum 2-axis scan velocity and/or have a faster response time than a system that only accounts for each axis individually.