is VHDL unsafe with state machine?

We trust the fpga will start up with zeros on all flips. No problem here. For nonzero power up then the issue Rysc raised is just implementation for cases when register must startup with 1.

The problem is that vendors themselves say don't trust our power up. Not that they can't do it but they can't guarantee what happens at intrinsic reset release after configuration. You may for example have an active external clock that upsets timing...etc.

The solution is quite simple. Use your own reset and it should be safe. With your own reset you will have better control of recovery/removal etc.than device wide reset release.