His argument mostly makes sense up to the point where he says tests are the only solution... Why not default to overriding the safeties, then use them where your reasoning says they ought to hold? Cheaper than writing a bunch of tests just to guard against null pointers.