Agree. It strikes me as silly that C++ doesn't provide something like a `CHECKED` macro, so that operator[] could always be range-checked in debug/dev builds, but not in release builds. The two-different-methods approach seems awfully clunky - what ends up happening is that no-one uses the `at` method. I see no good reason not to enable range-checks by default in debug builds.

This 'unsafe by default' philosophy isn't universal in C++ though. The smart-pointer class-templates are always thread-safe, despite the possible performance consequences.