Sounds like an ABS fault to me. Yes ABS is supposed to be "fail safe" however in rare occasions a faulty ABS ECU or (more commonly) an intermittent break in the cable to one of the sensors can lead to complete loss of brakes for a few scary seconds.
I've had this happen to me personally (in a Citroen, not a Leaf) and know a few friends on another car forum that have experienced the same, so this is not something unique to the Leaf.
The ABS hydraulic control block is connected "in series" with the brake lines from the brake pedal and by default is in a "bypass" mode where the pressure from the brake pedal/booster is passed through to the brake caliper unaltered. When ABS activates on a wheel a solenoid in the control block effectively disconnects that wheel's brake caliper from the supply from the brake pedal/booster and connects it to an overflow return, thus releasing the brake on that wheel.
So solenoid activation = brake disabled on that wheel regardless of pressing the pedal. When the pedal is isolated from one of the calipers this causes the pedal to travel further down so the pulsing on and off of the brakes also pulses the pedal up and down which is what you feel when ABS activates.
In theory a faulty or malicious (hacked?) ABS ECU has the power to operate all 4 solenoids at once effectively disconnecting your brakes entirely for an extended period of time all under software control. Obviously this is a very undesirable situation so there are a lot of safety interlocks in the ABS ECU but they are all software based so not infallible.
One safety interlock is that if the ECU detects any inconsistencies between the speed reading of the 4 wheels, such as 3 wheels saying 30mph and one wheel permanently saying 0mph, even without the brakes being applied, within a couple of seconds it registers a fault, brings on the ABS warning light and disables itself - in this disabled mode it will not activate the brake release solenoids in any circumstances, and you are now effectively driving without ABS - your brakes will work fine but braking hard will lock the wheels just like any old car without ABS.
However cable faults to a sensor can be more subtle - they are typically intermittent, depending on the steering wheel angle (for front wheels) and suspension height and movement over bumps etc.
If one cable goes permanently open/short circuit (or open/short circuit for extended periods of time) then one wheel will read 0 mph and the system will safely deactivate itself. However in rare occasions vibration of the cable can cause it to rapidly connect and disconnect dozens of times a second - this generates additional pulses that have the effect of fooling the ECU into thinking that the wheel belonging to the faulty sensor is going much
FASTER than the other 3 wheels.
So the ECU might think that one wheel is doing 50mph and the other three are doing 30mph. The incorrect conclusion it draws from this is that the faulty "50mph" wheel is the one that is OK and the other three wheels doing 30mph are about to lock up so it releases the brakes on 3 of the 4 wheels!
Even worse - the ABS on some cars, especially older ones, only has one solenoid shared between both rear wheels, so the rear wheels can't be controlled independently, so if the faulty wheel sensor is at the rear it results in
ALL four brake calipers being released and you have
NO brakes at all for a few seconds until the ECU realises that there is a fault and disables ABS. This can take anywhere from about 2-5 seconds depending on the ECU, during which time you have an accident or a brown pants moment...
Some ECU's seem to be easier to "fool" than others under sensor fault conditions. For example you would think that if 4 wheels were reporting 30mph and then suddenly one wheel reading intermittently jumped to 50mph the ECU should immediately think "that's not right" and disable itself, but apparently not, some ECU's will believe the instant change from 30mph to 50mph is valid and that the other three wheels that were doing 30mph all along are now actually locking up.
From the symptoms described there's no way its going to be brake fade or air bubbles. Definitely an ABS fault.
Unfortunately it could be difficult to find/prove. This sort of intermittent fault might or might not set fault codes in the ABS ECU - when it happened to me (albeit on an older car) no fault codes were set. The only way to catch it in that case would be to have a diagnostic tool running in the car while driving, monitoring the reported wheel speed of all 4 wheels as you drive, watching for any anomalous jumps or drops in the reported speed of one wheel compared to the others...
In my case I was unable to identify which wheel sensor was causing the issue but it gradually got worse until the sensor failed completely putting the ABS light on and since replacing the faulty sensor I've never had a "no brakes for a couple of seconds" failure again.
