The thing is that it&#x27;s not always possible to scope unsafety to unsafe blocks. The example of vec in the post above isn&#x27;t about haphazard  unsafe code, it&#x27;s about code within Vec&#x27;s module boundary being able to mess up invariants without needing to use unsafe.<p>This could be fixed with things like &quot;unsafe fields&quot; and &quot;unsafe types&quot;, but IMO that&#x27;s not really necessary.