Just to comment on this point:

> Enforcing safety seems like the right call

It certainly is, however it is hard to argue this point while looking at other more or less recent features:

string_view is basically a fancy "char *", with all the same use-after-free issues (same with other pointer range types and iterators)

Lambas with capture-by-reference can be freely copied and type erased into function<>, so obviously they did not care about safety when that feature got included