Even in the context of your refrigerator example (which I don't necessarily agree with), a kettle should have two thermostats - a primary one that keeps the temperature setpoint, and a safety cutoff in case the primary stops working. In both fail and the kettle is somehow drawing its nominal power for hours at a time, the main safety hazard is going to be the kettle itself trying to dissipate >1Kw.