This is correct in a memory unsafe language like C, where you can't make any assumption on the state of the program, so the only safe escape is to the address s

This is correct in a memory unsafe language like C, where you can't make any assumption on the state of the program, so the only safe escape is to the address separation boundary (i.e. the program). In a safe language you can usually make reasonable assumptions [1] regarding the blast radius of an assertion violation. And that's why rust allows catching panics. [1] even safe languages have unsafe escape hatches and safe abstractions sometimes have bugs, but on most cases you can assume that the runtime is not compromised.