>Why go through all the trouble to make a better array, and require the user to call a special .at() function to get range checking rather than the other way around?

Because the point was not to make an array type that's safe by default, but rather to make an array type that behaves like an object, and can be returned, copied, etc. I mean, I agree with you, I think operator[]() should range-check by default, but you're simply misunderstanding the rationale for the class.