Well, in principle, you could place each field in its own wrapper type that is unsafe to access. But you'd still have to be nearly as careful: there's no way around that, short of formal verification. Rust is ultimately a pragmatic language, and it lets the user pick their preferred balance between decreased performance, extra care, or extra line noise that people will get tired of reading. At best, it can give suggestions in the design of its standard library of where that balance ought to be.
