Disabling 'unsafe' by default

Great question! To me panic is a thread-local issue, whereas UB is completely pervasive. See Ralf Jung's recent post in another thread to this effect. Encapsulation and local recovery/restart can be applied to panics, but there is no recovery from UB because it's impossible to determine in advance what the compiler might do when it's API contract is broken by UB.