I wonder about an alternative history where the default feature set is much smaller and much safer, and everything else is opt-in behind a flag, and the flags are prefixed with "unsafe_" or something. That would hopefully encourage people to look up the "unsafe_allow_foobar" docs before using it.