What makes things worse, they were warned way before the event that the generators needed to be moved but it fell on deaf ears!
I work in the nuclear design industry and I'm told by people I work with who are far smarter than I that it is nigh on impossible for a modern power station to ever suffer a thermal runaway. Apparently the rate of reaction reduces as the temperature increases and they are designed in such a way that should the cooling system fail, that the reaction will all but cease long before dangerous temperatures are reached.
Yes, Tepco was well aware of the updated requirements for a higher sea wall and the relocation of the backup generators, they were able to avoid doing both of those things under "Grandfathering" regulation, because the Japanese nuclear regulator is not wholly independent, but rather chaired by the industry; it's captive. Ergo, it was an economic argument against the odds, the grandfathering, which ultimately bit them, and the whole prefecture, in the rear.
What you describe is effectively the fundamentals of how a BWR operates. It requires a moderator (light water) to fission, and when you remove the moderator (which is also the coolant on a BWR), the rate of reactivity decreases, so they are somewhat self-regulating in this regard with the operator sort of chasing the edge of this using control rods.
The problem is that latent heat production, even after the unit is shutdown, is considerable and traditional fuel elements are not able to withstand the heat generated without a coolant being present. This was one of the big problems at Fukushima, the spent fuel pool, that was evaporating its water and they had no way of replenishing it.
There are various Gen III+ designs that utilize different types of moderators, like liquid metals, and different fuel elements, that are self-regulating and "meltdown proof" as the moderator can't evaporate and the fuel elements are designed to be able to operate at much higher temperatures.
CANDU's require heavy water as a moderator, and the early CANDU's used a moderator dump as a 2nd shutdown system, because of course it can't sustain fission without deuterium. This was deemed "too slow" however, and would have allowed for fuel element damage, because of the heat issue described above, so it was eventually eliminated in favour of a faster acting gadolinium poison injection system.
