Safe isn't the best word to describe it with. But it does mean that any expression or statement always has two possible control flows. You have the "surface flow" as well as the exceptional flow, so there's an added complexity.

I never felt this was a problem when I did Java though (despite their awkwardness - basically forcing coders to not use checked exceptions.)

Rust's control flow syntax for Results and Options are very similar to this but with an added benefit: you don't have to use the ?-operator.

panics is different, however. They are more akin to the way any Java program will happily OutOfMemoryError or NoClassDefFoundError given circumstances not (always) in your control.