If both followers fall out of the ISR,
acks=all is satisfied by the leader alone, so an acknowledged write can be lost if that leader then failsAn acknowledged write can be lost, because the in-sync set can shrink to the leader alone.
The ISR (in-sync replicas) is the set of copies that are up to date with the leader. acks=all waits only for the current ISR. When followers lag or fail, the ISR can shrink to just the leader. With min.insync.replicas=1, nothing stops the leader from acking alone. So there is no guaranteed second copy. If that leader then fails, the write is gone.
This is why "Every acknowledged write is guaranteed to exist on at least two brokers" is wrong. That guarantee needs min.insync.replicas=2.
The usual production setting is replication factor 3 with min.insync.replicas=2.
Read more