> This is not done in practice because it would be a waste of verifiable type safety.

Why not? The current application is working, so I'd start with that and then gradually move away from it. But it seems they chose to go the opposite way.