In i.e. a TO-220 package, why is mounting the (pin connected) tab to case safe?
If your heatsink is connected to another net than the TO-220's tab you need some insulating materials to mount the TO-220 on the heatsink. In the old days they used a thin pad of mica for this, but today different materials (plastics) may be available that insulate and at the same time allow heat transfer to the heatsink. Martin mentions Kapton, but I'm not sure if that is a good heat conductor. Use thermal paste on both sides of the pad. You also need a round insulator to insulate the screw from the TO-220 as well. Some heatsinks come with the required stuff, or sometimes you can buy it in a small kit.