This was approach that OpenSSL does (it had its own memory management routines), and it already caused security vulnerabilities, not to mention performance issu

This was approach that OpenSSL does (it had its own memory management routines), and it already caused security vulnerabilities, not to mention performance issues. Rule of thumb: if you need to allocate memory region that will be overwritten anyway (for example reading a file) use malloc(). If you need a zeroed memory, use calloc(). As long as you rely on guarantees provided by the calls and use the right call for right use case you get predictability and very often optimization.