We sell a lot of fillers to distilleries, so my experience comes from aggregate information. Others on here can (and I hope will) share their own individual experiences.
Most commercial semi-automatic fillers are fed in one of two ways:
By gravity as you describe, where the final product is in a tank that is above the level of the filler's reservoir.
By a pump turned on and off by a level control.
The Mori Filler we sell can be fed either way. I would say about 80% of the Mori Fillers we sell are built with a level control/pump. The remaining are fed by gravity. Usually people opt for the gravity version for one reason and one reason only: cost. Unless you designed your facility to use gravity to your advantage, it is much more convenient to leave your tank on the ground.
The other benefit to using a pump to feed the filler is that you can run a final filter pass in-line just prior to bottling. You can't do that with gravity.
As far as the safety issues you ask about, most of the Mori Fillers we sell to distilleries use a completely air-driven level control and pump system that does not require electricity.