Failure strength depends on the size but generally the base material is going to fail before the Rivnut itself does. In other words, you'll tear the whole Rivnut through the sheet metal.
Which is a legitimate failure mode since the area you're using for the Rivnut is fairly small. It's similar to using a nut with no washer. Perhaps not surprising is then one solution is to put backing to spread the load over a larger area, like putting a fender washer behind the sheet metal and sandwich it in when you compress the Rivnut. In more challenging situations even that area isn't enough and the solution is to use a large supplementary sheet of material. Toyota does this in some places with captured nuts, like under the seat bolt tie points where there is a thick reinforcement to the sheet metal.
If you do this just remember to select a Rivnut that will accommodate the increased combined thickness when it compresses.
Another way around it is to use several Rivnuts. It's not quite as simple as two is perfectly double because depending on the forces you might not equally load, e.g. some might be substantially more in tension, others in shear, some in compression.
And of course just how they might fail is important. A 40 lbs tool box at 50 MPH has about 4500 joules of energy, which can do some damage. If you stop something 40 lbs going 50 MPH in a typical wreck (say deceleration in about 250 ms) it ends up looking like 363 lbf. It could be more, too, since that's only 9 times gravity and I think seatbelts are designed for about twice that. I'd probably at least do the fender washer trick. But that's more for an accident instead of trail flops. A 40 lbs tool box at 5 MPH has 45 joules of energy and the force tempo is low and slow, so should be plenty within capacity of a Rivnut in sheet metal.
