This is just how you work with large code bases. Updating 15,000 call sites is far from trivial. These changes happen in multiple phases, and in each phase, you still want to have a working kernel.
The unsafe version can be deprecated and eventually removed, but that is down the road.
The unsafe version can be deprecated and eventually removed, but that is down the road.