.. ...As others have already stated, casting immutability away is something that has to be supported, e.g. to interface with const-agnostic APIs. `@safe` requires such casts to be more verbose, with good reason.
I concede ;-) That the compiler knows this is @safe: cast(char[])iStr.dup; and this is not @safe: cast(char[])iStr; is sufficent.