Let me start by saying that waterborne adventures are definitely the thing for high-level characters - and it should be. Using my own group as a template, there are assorted magical items among the group like boots of levitation, wings of flying, potions of water breathing and so on that would help tremendously in times of crisis. Moreover, most of these characters can produce a kind of signal and can be located and saved through spells . . . and if anyone is really in trouble, the 11th level druid can turn into a great big animal of some kind and pull them out of the water, even during the worst storm. In a fantasy world, we must begin by acknowledging that once characters have achieved a certain level, most of the traditional horrors of total-party-kills at sea are highly improbable.
But let me address Kernan's concerns, because they do apply to everyone.
Sea Lanes versus Pirate Waters. Here, once again, my trade tables come to the rescue. I have already created sea lanes for ships in my world - and in doing so I was immediately struck by the potential for identifying encounters at sea. However, I couldn't argue that a sea lane would be "pirate free" - it follows that the pirates will go where the plunder is. Still, a good captain should know what ships are going to be taking that route both ahead and behind the player's ship, so that the ship can catch up with naval patrols or hang back to ride close to the convoy that should have left a day later. Player ships can even join convoys, perhaps free or for a fee, if players are prepared to wait for the right day. Those things would be true of sea lanes and would provide protection.
Off sea lanes, however, one shouldn't suppose they're particularly dangerous. After all, pirates won't be hunting there, since they have no expectations - and it is a lot like being a mugger and targeting people who have money. If you dress in a particular way, have a particular walk, show particular signs of being too much trouble while probably not having a lot to be stolen, you can walk right by a mugger and they'll even say hello. A ship that is off route, even one sitting low in the water, is probably carrying grains or mineral ores that don't make good plunder. That might be mitigated if the ship is known to the pirates (they do their research too) or if it has been damaged in a storm, so that it is plain why the ship is off-route. But it isn't as simple as trade-route good, non-route bad. There are many factors to consider.
Storms. Yes, I am adamant about building rules that will force crew to manage the ship at all times, not just during battle (and not just during storms, either). But I've been arguing that about land travel, too. I'm just waiting for the necessary epiphany that will give me the formula that will combine everyday travel damage with character agency (decision making) so that it isn't just arbitrary damage. It is easy enough to punish people for entering a wilderness (including an open sea) - it is much harder to build those rules so that the players have some control over the results. It is in the mental planning stage.
I really want to get rid of the "randomness" that Kernan refers to in sea travel. This phrase: "Sometimes a big storm catches you in the right place and it is all over" is telling. Truth is, storms that swallow up whole ships without a sign are really, really rare. Even a yawl is a profoundly big mass of wood and air bubble, making it very hard to sink. Storms have always come along that were able to completely decimate ships as big as a Spanish galleon - but ten thousand ships could brave a hundred storms each and only one or two actually go down with all hands. That is why tales of specific ships that did go down gain status. It sounds appropriate, but a game table that describes the storm effects on a vessel shouldn't even include "ship sinks." The ship probably won't. The real danger is that a lone person will be swept off and no one will even know that it has happened - that is where most loss of life actually occurred. Yet this can be controlled if the party is high level, as I've said.
The chief concern the players should have with storm damage isn't a TPK but rather the cost of repairing the ship afterwards. Everyone of high level will probably survive the storm; they will probably limp into the nearest port on three sails they had stored below decks. But they may also be stuck for months in some backwater like Liberia or Nicaragua while they wait for their ship to be repaired, with devastating cost with local materials and poor skills (which may require another refit once they've reached a proper port). A really bad storm could cost then tens of thousands of gold pieces - which is upsetting but not on the level of everyone is now dead.
Kernan has the right idea: we want the players to have choices like changing their route, choosing the season, dumping cargo and so on. This only works, however, if the consequences are equal to the decisions. If I had a rule on land that if a character decided to go off-road, there was an automatic 1 in 100 chance that they would trip on a root and spike themselves in the throat on a young tree that had been chewed off by a beaver, no one would ever think that was deserved. We should always view anything we put on a random table, no matter how unlikely, as something we intend to do to the party. If there is any chance that the time comes and we realize that, no, that's not a reasonable consequence in a game, making us forego using it and rolling the die again, we shouldn't put in on the table.
I may conceivably drown a whole party with a ship - but it will happen because thing after thing went wrong, making it so obvious that it has to happen that we're all nodding our heads around the table: "Wow, can you believe this actually happened?" It won't be a random result on a table.
Winston Rowntree made a really good point about this with air travel, regarding a 'perfect storm' that came together with the runway collision at Tenerife in 1977:
So, yeah. It does come back to the arbitrariness of DMs, who if they were creating a role-playing game based on world air travel, would be sure to include on their d100 table that "00" = "Runway collision - everyone dies." This is the sort of extremely poor understanding of odds that insists that the most interesting result possible must have a reasonable chance of occurring in an RPG. This leads to Kernan making the very reasonable observation that he doesn't want his whole party dying at sea.
That observation, however, is a learned experience from playing too many RPGs and video games, repeated from older grognard to green DM from decade to decade. Sometimes the apprentice system really chokes.