Description: This function doesn't check if the _to address is valid, then could lead to an evitable fund loss.

Proof of Concept: You can check in the solidity documentation that

The low-level functions call, delegatecall and staticcall return true as their first return value if the account called is non-existent, as part of the design of the EVM. Account existence must be checked prior to calling if needed.

Recommended Mitigation: Check the existence of the account before making the call.