On the assembly instructions, page 39 shows the boiler assembly has a therm-o-disc thermostat fixed to the top. It's not labelled, you just have to recognise it. The schematic on page 44 shows it's wired in series with the boiler's heater. That provides redundancy for the main temperature control, which is presumably the microcontroller sensing from the PT1000
Page 32 also describes the installation of an overpressure valve (which appears to return water to the cold tank?)
The machine does lack hardware run-dry protection though; as far as I can tell, it relies on a load cell to detect if there's water in the tank. If you ran it without water to conduct heat from the heating element to the thermostat, the thermostat wouldn't function. So it's not entirely safe, as you say.
[1] https://diypresso.com/wp-content/uploads/2024/05/2024-05-27-...