That's TLS, crypto, and git-protocol code physically leaving the process that turns your source into machine code, and compiling the fetcher in ReleaseSafe while the compiler itself doesn't is the right call for code parsing untrusted network input.