Why is three safety levels need in D?

[Nordlöw via Digitalmars-d-learn]

On Thursday, 17 November 2016 at 17:33:33 UTC, Stefan Koch wrote:
> Memory is inherently unsafe. But it can be treated in a safe 
> way.
> A language that does not allow you to express a middle ground 
> will have a lot of unsafe code that could arguably be seen as 
> safe.

So in what way would, for instance, a Rust-implementation of D's 
`Mallocator` be different and more unsafe without `@trusted`?