"We need to wrap this struct up into a higher-layer API that is safe for our users to call. As the driver author, we manually verify the unsafe code is correct, and then present a safe API for our users so they don't have to worry about it (provided they trust us to get it right!)."
Rust lets you write clearly defined unsafe code blocks. It's not a bug, it's a feature:
https://doc.rust-lang.org/book/ch19-01-unsafe-rust.html
https://doc.rust-lang.org/nomicon/index.html
It's worth reading through the whole Embedded Rust book even if you won't be implementing such software. It's interesting.