thread safety with Arc which violates interior mutability