Remember the currently common margins account for the fact that you actually use some of the water every now and then. That water in the tank will regularly cross the merely transiently safe temperature range, by design.

Once silicon is in control (which is where responding grid requests to delay consumption is more or less necessarily heading) you could even achieve better (worst-case) safety margins at reduced (total) power consumption. Because the machinery no longer needs to be designed around two "dumb" thermo switches and do a little extra in case layers of varying temperature manifest after two or more spaced periods of consumption. With continuous monitoring in software, you can integrate the worst-case bacterial growth based on time elapsed outside the "practically safe" temperature ranges. Then the tank always knows what is needed, and can both operate on tighter margins and reliably know when reducing or delaying power draw is ok.

Of course. The likely scenario is that the water tank has a preset range of acceptable temperatures and uses demand forecast information to decide whether to heat to the upper end of the range or let it cool to the lower end. Nobody suggests that we let them cool to unsafe temperatures.

They have to be _brought_ to that temperature periodically, but they don't have to stay at it; if they did you'd never actually be able to use the water (as that tends to drop the tank temperature, dramatically).

Its ok if the tank is heated up to 60C once per week to avoid Legionella.