&quot;I&#x27;m relieved to hear that at least it doesn&#x27;t pollute beyond module boundaries.&quot;<p>This isn&#x27;t true, it is easy to come up with an example where lack of safety spreads past module boundaries.<p><pre><code>    impl Vec&lt;T&gt; {
        pub fn evil(&amp;mut self, len: i32, cap: i32) {
            self.len = len;
            self.cap = cap;
        }
    }
</code></pre>
If we want to know our program is broken now, we need to look across all of the source code to see if evil is called in breaking ways.<p>The point was that Rust provides abstraction facilities which allow us to contain these invariants. If we are careful.