Well as already mentioned, depending on the rest of the system, the lack of a thermostat isn't necessarily dangerous. What would happen si that left on too long, the water would start boiling - more like simmering due to the volume involved. That would drive boiling water & steam over the vent pipe into the feed tank, with cooler water flowing down the fed pipe. The feed tank woudl heat up, and would steam up the loft - but nothing would actually happen as long as everything was capable of taking the temperatures, the case with old all-metal systems.
At some point the home owner would notice the noise from the tank and switch it off.
As mentioned, these days (or for some decades) the feed tank would be plastic, and when it got hot enough it could fail - dumping a large quantity of hot water through the ceiling. But that should not happen with a modern immersion heater as both the normal (service) stat and the separate safety stat (which is of a manual reset type) would have to fail.
Now what is spectactular is when the plumber doesn't put the stat bulb in the pocket ina new boiler he's installed in some offices. The system got hotter and hotter - obviously after the plumber has left - until the boiler boiled and the vent pipe was like old faithful blowing off. Then when the boiler was dry, no more steam to keep the water out, so cooler water from the F&E tank flows down into the boiler and the cycle repeats every few minutes. Each cycle lost enough water that the cold make up kept it fairly regular.
I was doing the network install there, and it was I that spotted the stat error and popped the bulb into it's pocket.