You are indeed correct regarding the simultaneous commit...I had to go back to a document I prepared a couple years ago to find the answer.

In high safety mode the synchronization workflow consists of two major steps...

...Transmitting and committing the transaction log blocks to disk on both mirror participants

...Applying and committing the transactions to the database

I have an image of the workflow shows the issue pretty clearly. I will post as soon as I can...might take an hour or so...and I will update this thread with a link. The bottom line is there is window of opportunity for transaction loss between the time the transaction is logged on the Principal and the time the Principal sends a commit request to the Mirror.