by Gordon Fox: 4th in a series

Risk is estimated from data
Risk estimates come from data on patients. The fact that the numbers are "estimates" does not mean that they are guesses or made up - it means that they are calculated from real data.
Where do the data come from?
Some of the data comes from prospective studies: patients are enrolled in a study, and their health is monitored for some time. Afterward, we can ask what fraction of patients developed the problem being studied (for example, what fraction of obstructed patients needed septal reduction). If the study is large enough and well designed, we can ask further questions, like how that fraction depends on age, sex, or the patients' gradient at the beginning of the study.
Sometimes, information comes from patient registries. For example, everyone receiving an ICD is asked to enter a registry, and every year after that, they are asked whether their ICD has discharged. Then, we can ask the same sorts of questions: what fraction of patients with ICDs had appropriate discharges (or inappropriate ones) in a given time? Does that depend on factors like body weight or whether the patient has an identified mutation that promotes HCM? And so on.
There are other ways to get risk estimates, but these two are the most reliable.
Bottom line
Bottom line: the estimates of risk come from real data. Some problems come from the way the data are obtained. Scientists know how to handle those problems.
Why is “risk” an estimate?
In everyday language, "estimate" often means "guess" or something similar. Scientists don't mean it that way! Almost all numbers in science are estimates – that means we are calculating the numbers from data using well-developed scientific tools. It doesn't mean that somehow the number is made up.
And why do the estimates change over time?
Risk estimates can change over time for several reasons. First, we learn more about the science over time. That means we can ask better questions with research, which can change our risk estimates. Second, research samples vary. If we conduct three studies, each with 100 patients, we will likely get three somewhat different numbers. That's because the group of patients used for each study differs slightly from the others. As studies accumulate, it is natural that risk estimates also change.