Even if you write "unsafe"-free Rust that only relies on the Rust standard library, you need to trust:
- The Rust compiler and everything it uses to be correct (not just memory safe), e.g. LLVM.
- The Rust standard library, and everything it calls in to, e.g. system libraries, the kernel, the CPU.
That's a ton of code. By calling into an additional library that uses the "unsafe" keyword, you're just adding that library to your set of things you need to trust.
Naturally, you probably have higher trust in the Rust compiler and OS kernel then you do in some Rust library on GitHub, but nothing is 100%.
And the GitHub Rust library probably only uses a few small blocks of "unsafe" code. That makes it easier to audit and increase your confidence than if it were written in C.
Plus, the Rust safety guarantees don't cover everything. You're still trusting that the library doesn't have a bug that accidentally writes to the wrong file, or sends the wrong value over the network.
C++ defines a memory model, allowing programmers to "rely" on certain guarantees from the compiler and runtime library. But you're still trusting the C++ compiler, the runtime library, the OS kernel, and the CPU to work the way they're supposed to. That doesn't mean the C++ memory model is useless.