Because the RTL level only supports type based aliasing, and very simple TBAA at that.
But we're just talking about type-based aliasing. You are saying that an access through this pointer can point to anything, regardless of what we think it points to. No. If you know what it points to by value-based information, that can safely be used. The only thing is that you must use alias set 0 for any type-based information. This leaves 3 or 4 places at the tree level that need to be changed, and possibly more later as more aliasing techniques are added. I don't see why. Why is there more than one place that computes the alias set of what a pointer might point to?