Voltage sensing is best done in the secondary. You want to sense the actual voltage that can do any damage if it goes out of spec.
Current sensing should also be done in the secondary, but in this case, since you have a single output, you can do it in the primary. The primary will reflect the secondary current well and it's much easier to do, since you do not need isolation.
But if you have multiple outputs, then the primary current only tells you that the sum of the output currents is within limits. Yet one of those secondary currents could be outside the range, while others are at zero. Thus, the primary sensing would be good to indicate general overload, meaning that the TOTAL output power is being exceeded. But the individual output currents should be monitored separately.
Primary sensing can also detect a failed transformer of rectifier. Any of these failures will cause increased primary current, although the output currents are zero or within range.
Overvoltage and overcurrent generally cannot occur simultaneously, but I think it is conceivable that in a certain configuration, given a certain fault in the circuitry, you might encounter them at the same time. For example, on overvoltage condition is present, but the circuitry does not respond, you apply too high a voltage to the load and the load draws excessive current.