OK, so the materials all around the heater were designed to get hot; that's reassuring. Keep an eye on the wiring you use to connect the heater, sensor and thermal cutoff switch: Silicone insulation is probably what you want, maybe with an additional silicone sleeve for extra protection (and tidy wiring).
In general, you want to design everything "single fault tolerant" -- i.e. if one component fails, the unit should still be safe (although not necessarily in working order). The thernal cutoff protects against a failure of the sensor or the controller; grounding the external metal parts should protect against electrical shock if the insulation gets damaged, etc.
If you are particularly concerned about a specific component, you could provide redundancy for that one, e.g. by connecting two temperature sensors and letting the Raspberry shut things off if the readings deviate too much. But I dont think that's needed here, with the thermal cutoff already taking care of sensor failures. Note that using only two redundant sensors read via software, without a hardware-based thermal cutoff, would not provide single fault tolerance -- a single controller failure could make them both inoperable.