In this case the pool boils off slowly enough from thermal load to let decay heat reduce to the point where air cooling is adequate. So it remains passively safe unless there is a sudden loss of water from the pool.

Engineering a very resilient pond does not feel like as complex a problem as engineering highly complex cooling systems to be resilient.

And if you size the pool right it will by cool before the pool boils off. It's simple math and engineering.