From a security perspective, panic at runtime is not that bad for security. Much better than continuing to run with undefined behavior. If someone sends a malformed video in and it crashes the ffmpeg process you can just log it and restart it. Vs potentially exploiting the system.

The Rust standard library has `NonZero<T>`, which, if used, at least forces you to consider what you initialize it with. Doing

  let foo = NonZero::new(unvalidated_input).unwrap();

is at the very least a big red sign that stands out in the code and should fail code review.