The statement that a JIT is itself unsafe is tantamount really to saying that “compilers are unsafe” or even “interpreters are unsafe”. All a JIT really is is a

The statement that a JIT is itself unsafe is tantamount really to saying that “compilers are unsafe” or even “interpreters are unsafe”. All a JIT really is is a way to execute code. As an example, the Rust compiler has some [60+ open unsoundness bugs](https://github.com/rust-lang/rust/labels/I-unsound https://github.com/rust-lang/rust/labels/I-unsound), meaning that there are many, many ways that a sequence of ostensibly safe code could be compiled into an unsafe executable (i.e. one which exhibits an unsafe behaviour like a double free). If you allowed malicious users to run Rust code on your machine, even without unsafe features and a limited standard library (as the case with JS in the browser), they could take advantage of these compiler bugs to escape Rust’s safety guarantees and whatever protections you put in place. And these bugs exist even though Rust itself is a safe language, and even though much of the Rust compiler is itself written in a safe language.