Well, I see two ways it might be: the operations are not really safe in an absolute sense or the operations composition does not preserve safety.
Or you could say that an operation can be safe in a context but ops+context does not compose as well as we would like to guarantee the preservation of safety
