Thermometer type in electrical water heater
I believe that @TurboJ is correct that there is no galvanic isolation. That would make the signals very difficult to deal with safely- the sensor appears to be tied to one side of the mains. 

As it's clearly (well, after the good research done by user222030 and Majenko) some kind of dual NTC resistance probe it will be very nonlinear and referenced to some voltage such as 3.3V or 5V on the board. You would have to reverse engineer the circuit and then you'd still have an nonlinear nasty voltage connected to one side of the mains, ready to blow the living **** out of your home automation system, damage the boiler controls, or electrocute the hapless user. 

While you could attempt to introduce another sensor into one of the protection tubes it would have to be insulated sufficiently for the mains to be safe.. which may be non-trivial and I don't think it would be responsible to try to make suggestions remotely on how to do that.