Such landing is safe, reasonable and completely standard business.
The ILS transmitter is rather simple, so there is not that much that can go wrong. But to qualify as category III, only which can be used with no decision height, it additionally needs monitoring circuits that check whether the correct signal is being transmitted and shut it down if it transmits incorrect signal. There is a strict limit how fast the monitoring circuit must react and the whole system is regularly tested. The monitoring system is already needed for category II, but with weaker limits for reaction time. Additionally the tower ensures no other aircraft and vehicles move in area around the transmitters where they could affect the signal propagation.
On the aircraft side for auto-land dual channel autopilot is required. So there are two systems that decode the signal and calculate the control input. If the systems disagree or if the signal fails, alarm is sounded and the pilot flying will initiate a go-around.
The controller on tower sees the aircraft on radar, so can verify that the aircraft is indeed approaching the intended runway. If the signal fails in the very last moment and there is not enough time to go around until wheels touch the ground, the aircraft won't have time to divert from course significantly, so the wheels still touch down on the paved surface. If the lateral signal fails during roll out, there is some risk of runway excursion, but that's what the safety areas are for. Runway excursions (to the sides; overruns are another matter, but they are not significant risk here) rarely result in injuries.
This is really the same level of safety as for any other system you rely on like engines or hydraulic flight controls and many other systems in the aircraft.
Note that since there is no taxi guidance, landing in zero visibility is not really possible anywhere (except, as raportech97 correctly noted below, in emergency). Some visibility is always needed (50 m should be the lowest, airport and aircraft equipment permitting) that also gives pilots chance to manually control the roll out in case of localizer failure in that phase.