Are you speaking from experience or did you just study the f/w? I agree, gotta have those thermal switches, and they need to result in killing power on threshold breach.
I read the firmware, it's build with the Arduino IDE and PWM for the heater element is bitbanged and updated from the main loop. Meaning it can easily get stuck sending a MQTT message over wifi when it loses connection, causing the heater to possibly be left on indefinitely.
