Rust's main selling point is a type system that allows safe wrappers around unsafe code by encoding invariants in the types themselves. Stuff that lives in the

Rust's main selling point is a type system that allows safe wrappers around unsafe code by encoding invariants in the types themselves. Stuff that lives in the documentation like "you need to call foobar_free" becomes an unsafe block in a safe Drop implementation that only needs to be extensively tested once to validate the safety of the wrapper. Once the safe-unsafe interface is tested, downstream code doesn't have to worry about the unsafe implementations at all. Without unsafe, Rust programs would be useless since the Rust compiler can't verify the safety of external libraries that provide critical functionality like memory allocation and syscal interfaces (I/O). It would also go against one of Rust's main goals which is C FFI compatibility, which is something that the Rust compiler can't verify.