A certain loss of safety is common when you're using FFI.

Take any language's FFI and bind to the C library atoi function. Poof, you have instant undefined behavior for bad string to int conversions.

If you want a safe, robust module that is based on FFI, you have to write some padding in the higher level language that avoids misusing the foreign API in any way.

Directly exposed FFI stuff is not safe and cannot reasonably be safe; it makes no sense to expect that.

I disagree that this is a FFI. There's are FFIs for Python, the builtin one is called ctypes, and users know it's an exception to Python's safety. Modules implemented in C++ and presenting functionality to Python programs in a native way are expected to be safe.

Unless I'm mistaken, the topic is Pybind11, which is a foreign binding mechanism. Being criticized is the example in its documentation:

http://pybind11.readthedocs.io/en/master/basics.html

under the heading "Creating bindings for a simple function".

Looks like FFI to me.