It's not as pessimistic as it sounds. The task of "make the handling of the unsafe as safe as possible" can be quite easy; in some cases, hiding the unsafe in a module and only exposing a safe wrapper means there's only a small amount of code you have to review.