Any public API using `unsafe` code that can't enforce its own unsafe invariants should (and in practice does) get marked as `unsafe` itself in order to force callers to use `unsafe` when calling that function. Of course it's something that, by definition, the compiler cannot enforce on its own and hence requires social norms and social pressure to enforce, and it's therefore fortunate that the Rust community takes it very seriously.