I have much more experience with the ER-X than the hEX S (but I do have a hEX S in my home lab).
My opinion is that the EdgeOS/vyatta commit-confirm is a better anti-lockout solution than safe mode in RouterOS, but it may be that I just don’t know the correct way to use safe mode (here’s the reason I am thinking of).
The other anti-lockout feature I miss on the hEX S (versus the ER-X) is the lack of access to a serial console. On the ER-X, (and the hEX) there are motherboard connections for the serial UART. On the ER-X there is are pre-soldered in header pins you can connect a “Rasperry Pi debug / console cable” to, and I find that extremely useful, and my lab ER-X lives with the cover off and the serial console connected. But the hEX has pads that a serial console connection could be soldered to, but from what I have read, the firmware does not enable console access via the UART, and in v7 even with a USB to serial device connected to the hEX’s USB port. See this for example. Here’s more about the serial console in this thread hEX (RB750Gr3) Serial Console
But the key to not locking yourself out is to always work from a port you are not making changes to. If you would have removed a port from the bridge, assigned an IP, allowed access and then logged into that port, you would have been able to change the bridge config without locking yourself out. Also, having a backup before making changes is important. It appears you can use WebFig files section to make backups but I didn’t try. I use WinBox. You can also use ssh and /system backup save name=mybackup and then using scp to copy the file from the router to your computer.