This might not quite mean what you think it means, by the way. In practice it is almost always just a property of the IP macro they use for the physical GPIO design, and its functionality is not tested - at all.
The reason for this "eh, good enough" approach is that it is intended for potential shocks during manufacturing: they don't want it to definitely die during a freak shock in an ESD-controlled environment. The rating is only for single shocks (so no repeats, as you'd see in the wild) and only for 2kV (not the 15kV you'd see in the wild, let alone the odd 30kV one for static-prone people) because that's all it is going to encounter during assembly.
I made the exact same mistake with one of my first commercial designs. And then after a while the reports of weird cases of single-pin GPIO failures started rolling in...
> The AMS1117 is just more available than the alternatives.
Keep in mind that this is both a blessing and a curse. It is more available because there's a giant number of clones, all of which are going to behave slightly differently. Your design with MLCC capacitors is outside of the regular operating parameters. It might work fine now, but don't be surprised if it starts failing on the next production run because the fab substituted it for a different AMS1117 clone to save a few cents.
At 2500 units your run is big enough to order whole reels of parts. There are dozens of drop-in replacements for the AMS1117 which are perfectly fine with low-ESR capacitors. Considering your sales price you should be able to afford splurging 5 more cents on a proper modern alternative from a reputable brand, so why take the risk?
When making decisions like those it is important to ask yourself one crucial question: can your brand survive both the financial and the PR blowback of, say, a 10% failure rate on your next batch? When you are selling a premium product at a premium price - and you are - your customers expect premium quality as well. Ironically, you literally can't afford to cheap out on parts.
> But at 3.3v and 232 mW it's not a fire hazard. It will fail open
"Fail open" in practice means "catches fire". Will it spread to other parts? Probably not, if everything goes well! PCBs are fairly hardy (the "FR" in FR4 stands for "flame retardant", after all), your parts are fairly spaced-out, and there's even a chance you might've used an overkill self-extinguishing plastic for the housing. But can you afford to ignore the potential risk? How will your customers react when it does an Nvidia 12VHPWR and the freak 0.001% failure is suddenly front-page news for your community?
Hardware design isn't merely about making it work. Things like design for manufacture/assembly (kudos on the one-screw method, by the way!) are just as important - as is designing it for reliability. Your work isn't done when it functions, but when it can't reasonably fail in any way that matters.