Hasn't Python always guaranteed messing with __annotations__ directly, as unsafe?

This isn't some bug. It's documented behaviour.

Python doesn't try especially hard to stop you from doing stupid things in general. It's kind of core to the language that it doesn't. Hence no access modifiers. I think it's usually phrased as "we're all consenting adults".