Around 3.5 of those pages are unsafe uses for implementing the same trait for garbage collection. The implementations seem very simple and the documentation mentions invariants that are easy to hold so it should be easy to recognize an unsound implementation. I think that it should be possible to not use unsafe at all for some of those but I only skimmed over the code so I'm not sure.

Most of the rest of unsafe uses are to skip rust checks that have already been asserted and for FFI which is unavoidable.

There are only a few unsafe uses whose invariants are not well defined. I only gave it a quick look but I doubt they're risky.

Even if an attacker manages to exploit ruffle, I wonder what could they do in a WASM sandbox in an isolated domain.

In this context any usage of `unsafe` in Rust is probably irrelevant to the safety of the resulting program, because AFAIK the WASM sandbox doesn't trust programs enough to actually allow them to do anything that could potentially violate memory safety.