"I'm relieved to hear that at least it doesn't pollute beyond module boundaries."

This isn't true, it is easy to come up with an example where lack of safety spreads past module boundaries.

    impl Vec<T> {
        pub fn evil(&mut self, len: i32, cap: i32) {
            self.len = len;
            self.cap = cap;
        }
    }

If we want to know our program is broken now, we need to look across all of the source code to see if evil is called in breaking ways.

The point was that Rust provides abstraction facilities which allow us to contain these invariants. If we are careful.