In both ToString for T: Display and format!(), it is assumed that no Display implementation will ever return Err(_) because none of the methods of Write for String do.
Given the Display trait does not document that it should not fail on its own, I think both ToString for T: Display types and format!() should unwrap the calls to Write::write_fmt instead of completely ignoring their result.