Yes. And? You seem to forget famous saying. Perfect is the enemy of good. Rust std wasn't yet verified to not contain unsafe behavior. In fact, some modelling

Yes. And? You seem to forget famous saying. Perfect is the enemy of good. Rust std wasn't yet verified to not contain unsafe behavior. In fact, some modelling discovered and fixed unsafe behavior in Rust std libs. Same happens here. If you discover that for inputs you have unsafe behavior calling ffi, you uncapsulate it in way that prevents misuses or fix in source ffi lib.