Rust has to have some equivalent to `unsafe`; it is designed to be used for low-level code, and opt-in unsafety is far better than opt-out. Anything like FFI is

Rust has to have some equivalent to `unsafe`; it is designed to be used for low-level code, and opt-in unsafety is far better than opt-out. Anything like FFI is outside the realms of what a compiler can possibly verify, since it knows nothing about what the arbitrary C functions do, or what pre-/post-conditions hold. Furthermore, all the normal tools provided by Rust are available in unsafe blocks. The low-level code has to be written somewhere (Rust needs to have a vector type, needs to have an efficient hashmap), and frankly, writing it in Rust is better than writing it in C and using FFI to import it. Rust is going for safety.