Stepping back from concurrency for a second, you can't even implement `RefCell<T>` without `unsafe`. Any method that takes `&self` and performs "interior mutation" is unsafe to implement.

Not sure whether you would consider that to be by "design", "necesity", or a "compiler/language deficiency".