In this case the pool boils off slowly enough from thermal load to let decay heat reduce to the point where air cooling is adequate. So it remains passively safe unless there is a sudden loss of water from the pool.

Engineering a very resilient pond does not feel like as complex a problem as engineering highly complex cooling systems to be resilient.