I honestly assumed this would be yet another safety issue, but it turns out it's just another example of my nemesis: the ease by which a reference becomes a value and triggers a copy. It's super annoying because the the messaging is "use references to be a pointer that cannot be null", which fails on multiple levels - this one where it becomes a value copy, but also that references can happily be null (many years ago I filed a feature request on clang asking for a non-null attribute that was rejected because references exist).