unsafe is sometimes necessary because Rust's safe APIs are needlessly inefficient.

For example, consider a function for 16 byte equality:

    fn equals(v1: [u8; 16], v2: [u8; 16]) -> bool {
       v1 == v2
    }

rustc emits a branch to test if v1 and v2 point to the same thing, which is unnecessary (it can never be true!) and can ruin loop vectorization, etc. The useless branch is not serving any safety purpose but requires unsafe to avoid.

https://rust.godbolt.org/z/6973jG

The efficient version is quite a bit more verbose :(