1) A properly functioning GFCI receptacle is going to be protection.
2) But GFCI's -- especially exposed to the elements -- fail all of the time. That's why one is expected to test them at least once a month.
3) If the GFCI has failed then there is a small, non-zero, risk that the insulation within the motor could breakdown.
4) Due to human sweat, every tub or spa gradually becomes salty -- and quite conductive.
5) The very act of pumping a conducting fluid through an electric field induces a current -- and voltage. This happens even if everything is totally squared away. Very few tub designs shield the circulating water from this effect. [Faraday discovered it, BTW.]
6) Consequently one is well advised to bond every hot tub/ spa to ground with any factory supplied lug. It almost certainly is doing double duty: bleeding off induced voltage (per 5) and providing a back-up short circuit path back to the panel, lest the GFCI fail in use.
The way this is done in elevator pits (notoriously wet) is that a bonding conductor (green) is wirenutted inside a nearby junction box (W/P, Bell box) and brought out to the equipment lug. Depending upon the circumstances, this whip can be naked (a forgiving situation) or enclosed in a raceway for protection from physical damage.
BTW the voltage effect can build and build. I've tested waters that had reached 45 VDC above the local ground voltage. Every time anyone exited the tub, they got a jolt to their groin. A trivial bonding run cured the problem in no time.
BTW, the national 'help' line for the manufacturer was totally unaware of the physics of their product: not a clue.
Their design had no mechanism for bleeding off the induced charge. (It was building up like a gigantic Leyden jar.)http://www.instructables.com/id/Make-A-Water-Leyden-Jar/