It could easily go past module boundaries. The point of the article is that the "unsafety" extends however far the invariants the unsafe code depend on extend.

It could easily go past module boundaries. The point of the article is that the "unsafety" extends however far the invariants the unsafe code depend on extend. I could have an unsafe function that depends on a set being non-empty. And it could share that set with, say, a factory in a different module. So someone could mess with that code and cause the invariants to be violated, and suddenly the code is broken. Unless you have a language that is capable of expressing proofs (ie, Idris) you have to depend on good documentation and careful/tasteful design to prevent this kind of problem.