Calling an unsafe function means "I promise to uphold the invariants required" and often that requires writing safe code a certain way. For example, in WGPU I

Calling an unsafe function means "I promise to uphold the invariants required" and often that requires writing safe code a certain way. For example, in WGPU I get the surface of an OS window. This requires an unsafe function call. The invariant I must uphold is to not drop the window before the surface. This requires writing my safe code a certain way. And indeed, a malicious actor could change only safe code and cause UB by dropping the window (I believe this would cause a double free when the surface is dropped). However, the struct holding the window and surface presents a safe API to users of the struct, and no code outside the struct can cause UB.