There is likely something elsewhere enabling safe_mode. You could confirm it by creating a phpinfo file in the XF directory and seeing that safe_mode is enabled there. It may also point to the php.ini file(s) in use, though depending on server config, the directive could be specified elsewhere.