How about this syntax?
let a = foo().unsafe bar(baz()).xyz(); // unsafe only applies to bar
let a = unsafe foo(bar()); // unsafe only applies to foo, not bar
I think this works well because it's maximally conservative.
If somebody gets confused and thinks bar would also be marked unsafe in the second example, they will just get a compile error.