This describes both Python and Rust. They are default safe, with escape hatches (ctypes or unsafe blocks) for rare situations. Writing unsafe code in Rust should be as rare as using ctypes in Python.

> is way better than one that lets libraries write unsafe code, which is better than a language with no safe boundary.

Python lets libs use ctypes to poke at raw memory. Solution: avoid those libraries

Rust lets libs use unsafe blocks. Solution: avoid those libraries (and optionally use tools like cargo-geiger or forbid(unsafe) if you care enough