Should a water-cooled converter (in this case for electric propulsion > 10kW) be able to protect itself against over-current and over-temperature in case of coolant failure or does it need coolant sensor information (flow/pressure/level) to survive? What is your view?

In case the power capacitor is a film cap, it will probably not survive the combination of over-current and over-temperature for longer times, due to hot spot.

Often the Liquid HS has very little mass, so upon coolant failure, the IGBT may overheat faster than the thermal sensors can respond if the current is on the upper end of the specification, for example, during a start or acceleration, and surly during true overcurrent.
Depending on the complexity of the control system, the temp and current can be monitored dynamically, in addition to "hard" protection. Of course this all adds cost and complexity - so the development of additional protection is a product dependent effort.

Thanks Paul. Makes sense. What do you mean by 'dynamically'? Do you mean by modelling/calculation the junction temperature (e.g. from duty cycle)?

I would not call it a model, but calculation covers it. Any given system will have the temperature affected by changes to the load current, with a certain characteristic. So for a given temp reading, you can calculate how much current can be allowed, or conversely, in your case, for a given current, the temperature should be in a range, if too high - a coolant failure is detectable - not 100%, but pretty accurate, For a coolant failure - it may also be valuable to set an alarm, vs shut down, but also limit the performance, kind of a "limp home" mode.