The reason for the recommendation is this: if you're using $SAFE_RECO, I don't need to think twice if what you're doing is fine. If you're doing ECDSA or ECDH

The reason for the recommendation is this: if you're using $SAFE_RECO, I don't need to think twice if what you're doing is fine. If you're doing ECDSA or ECDH over P256, it might be fine. It might also be a complete disaster. So, we don't recommend it -- and if you must, you should have someone audit it for you, because you're not in the safe zone anymore. (Examples of disastrous failures: P256 off-curve attacks, unsafe k choices for ECDSA.)