Well... .at() is bounds checked, but operator[] (which is what most people use) isn't.

It should probably have been the other way around, I'd say.