>Every study on security vulnerabilities has shown that "just don't screw up bro" doesn't scale.

Let's see them.

Well, ignoring all the reports from google, microsoft and mozilla, all of whom are part of a cabal spreading misinformation on the percentage of vulnerabilities caused by memory unsafety in C++ (all 3 arrived at around 70% so it's clearly a made up number they colluded to spread), and ignoring the reports from the United States government (probably infiltrated by rust cultists), I can recommend the paper Memory Errors: The Past, the Present, and the Future