I think the general idea of an escape hatch is sound, but it needs to be more explicit. Once you are specifying it, any dependency could also publish a new version with unsafe flags without you noticing that it happened. This could be a potential security risk, because you can use flags like -B to run arbitrary code during the build process. I think this would need to be a list of packages which are allowed to use unsafe flags instead.