The safety requirements of ISO13849 specify that you must protect against "foreseeable misuse". Not "all possible misuse". You're not expected to be a fortune teller, only to assess the machine and say "what legitimate reason might there be for someone to misuse this machine"?
I don't know the circumstances of the company mentioned previously who got in trouble because the operator removing the guard was deemed "foreseeable mis-use", but it's certainly possible that the judgement was reasonable.
Let's say you have a guard which protects a pinch point or some other hazard. Inside that guard is a sensor to detect some part of the process. Now, you can put in your operational procedures as big and bright as you want that you must LOTO the machine before removing this guard, but it's 100% foreseeable that one day that sensor might start playing up, and someone might make the decision to remove that guard to poke and prod it a bit to see what's up. Misuse of the machine, directly contradictory to your operator's manual and procedures - but it's foreseeable misuse. So, as the machine builder, you should identify that possibility and put a guard switch on that guard that will remove the hazard if the guard is removed.
But let's say this guard has nothing behind it that needs to be accessed. Maybe you might need to remove it once a year for a good spring clean, while the rest of the year a hose down will suffice. Maybe there's a bearing behind the guard, but the greasing points are accessible without removing the guard, and the only reason to take the guard off is if you needed to replace the bearing, which requires a total machine shutdown anyway. In this case, there's not really any reasonable (slash foreseeable) misuse to be had, so a fixed guard with no guard switch is probably just fine. You'd still want to provide other safeguards (like signage, administrative procedures, etc), and you'd want to document your decision in a risk assessment showing that you have considered the risk of foreseeable misuse and found it to be negligible. But if after that point someone decided not to bother putting the guard back on after spring cleaning because they couldn't find their 13mm spanner and anyway it was lunchtime, and then someone started up the machine, that's outside the scope of "foreseeable misuse".
Jesper, you have a valid point about operators using e/stops as machine stops, and thus reducing the diagnostic coverage of e/stops in series. And yes, this is something that will have to be considered in any assessment. The facility I'm referring to, operators do not use e/stops except in a legitimate emergency. This company subscribes more or less to the policy that "if I can see that machine from this e/stop, this e/stop should stop that machine". So, you press an e/stop in that plant, a whole s*** ton of machinery comes grinding to a halt. Which is absolutely the best possible outcome if you happen to be trapped in one of those machines! But the operators learn very quickly that this is sure as hell not a process stop. That comes into play in the safety validations they get done. Due to the operator culture and the overall design of their safety systems, e/stops in series can be deemed to have a relatively high diagnostic coverage.
On another site, I had a customer who wanted me to have e/stop pushbuttons only stop the exact piece of equipment they were physically attached to (or better yet, not have e/stops at all), because "the operators press them all the time". We were building him a new facility, and I saw the chance to fix this behaviour. What I did was to make all this e/stops stop the entire line they were on, and then at plenty of strategic positions around the line, provided black mushroom head "production stop" buttons. The operators had a hell of a time the first few weeks restarting their line every couple of hours, but the lesson sunk in pretty rapidly after that, and they realised that red button = my next hour is going to suck, black button = machine in front of me stops and I can clear the jam and continue with my day. Again, the e/stops now have high diagnostic coverage, because the operators have other easy means of stopping equipment without using e/stops.
If your machine has no easy way of quickly stopping the machine other than an e/stop, and it's foreseeable that the machine will need to be quickly stopped, then the diagnostic coverage of your machine will drop if you put e/stops in series. Once again, it all comes down to the risk assessment, which should take these sorts of things into account.