Proper thing is bounds checking should be by default and you actually have to turn it off for hot path code. Because 99% of the code people write isn't memory or CPU bound. If a little used code path is sometimes throwing bounds exceptions you want that to get logged in production.