Since any Rust function may use unsafe code, you don't know whether bets are off for any particular function call.

Any public API using `unsafe` code that can't enforce its own unsafe invariants should (and in practice does) get marked as `unsafe` itself in order to force callers to use `unsafe` when calling that function. Of course it's something that, by definition, the compiler cannot enforce on its own and hence requires social norms and social pressure to enforce, and it's therefore fortunate that the Rust community takes it very seriously.

Any Python function may use ctypes, any Haskell function may use unsafePerformIO, ..., so all bets are off all the time.

I don't think that's a particularly useful point, as is.

Not that this "makes the point", necessarily, but GHC Haskell does have the whole Safe/Unsafe Haskell module inference/guarantee, so it may be a bit easier to avoid unexpectedly unsafe behavior entirely.

I have no idea whether any equivalent exists for Rust.

There's not a module-level Safe/Trustworthy/Unsafe division, but as steveklabnik1 says, any potentially-dangerous code has to be placed into an `unsafe` block.

One can also forbid the use of any `unsafe` blocks for a crate/module (with the #[forbid(unsafe_code)] attribute), but this is slightly different to the {-# LANGUAGE Safe #-} pragma in that it does consider imports at all. However, since "unsafety" is modeled in the language in Rust, and is granular, people are encouraged to have every module be "Trustworthy" (in Safe Haskell terms): if an individual function could cause undefined behaviour if misused, it should be marked "unsafe", and a "Safe" module (i.e. one using the forbid above) won't be able to use it.

Rust requires you to to explicitly mark individual blocks of code as unsafe, and you can only do unsafe operations inside of them.

Yeah, in theory. In practice, if someone writes code that is throwing away compiler checks for no reason, you simply don't use it.

But very many pieces of code, even such pedestrian things as data structures require unsafe code.

So the attitude of "only unsafe programs have UB by the Rust spec" effectively means "all programs have UB by the Rust spec"