Counting instances of "unsafe {" is pretty useless. Unsafe is needed in "safe" code. What it allows is to create a boundary where the caller is the one that uphelds the contract. If the unsafe is in an internal library, it’s much more difficult to misuse.