The borrow checker eliminates data races and hard memory errors, such as access violations. Panics are well within the bounds of safety.

From the docs:

Unlike C, Undefined Behavior is pretty limited in scope in Rust. All the core language cares about is preventing the following things:

* Dereferencing null or dangling pointers

* Reading uninitialized memory

* Breaking the pointer aliasing rules

* Producing invalid primitive values: dangling/null references, a bool that isn't 0 or 1, an undefined enum discriminant, a char outside the ranges [0x0, 0xD7FF] and [0xE000, 0x10FFFF], A non-utf8 str

* Unwinding into another language

* Causing a data race

<snip>

Rust is otherwise quite permissive with respect to other dubious operations. Rust considers it "safe" to:

* Deadlock

* Have a race condition

* Leak memory

* Fail to call destructors

* Overflow integers

* Abort the program

* Delete the production database

https://doc.rust-lang.org/nomicon/meet-safe-and-unsafe.html