> C++ code can't be taken at face value -- the most innocuous-looking code could be a ticking bomb.

You can't take C code at face value either. The name of a method or type doesn't tell you what it does. It could longjmp for all you know.

See my reply to a similar objection: https://news.ycombinator.com/item?id=48520416