Comment by nuancebydefault

Suppose it is a dll that has exported functions returning or accepting unsafe strings. No way to make it safe without changing the API.