When you're using unconstrained delegation, a service A is allowed to authenticate as the user B to any other service. This happens because the user B sends its TGS along with its TGT to the service A, and service A can then request other TGS on behalf of user B. On a first look this would seem less safe than constrained delegation, because service A can authenticate against any other service. But this has a previous requirement. User B needs to authenticate first to service A. If service A somehow gets compromised, it cannot impersonate any user until that user first connects to it, and forwards its TGT.
When using constrained delegation, this doesn't happen, because service A has access to S2U4self. This allows him to request a TGS to itself on behalf of user B. This TGS can then be used to ask for subsequent TGS to other services because it has the forward flag enabled (-f) using S2U4proxy. Granted, it will only be able to impersonate the user against services whitelisted in the attribute msDS-AllowedToDelegateTo (since its constrained delegation), but this seems like a good trade off against being able to delegate any user without the need of that user first connecting to it.
Is my understanding of these features correct? Can unconstrained delegation actually be safer than constrained delegation?