I think more complex stuff might be written under those circumstances: https://www.redox-os.org/ https://www.redox-os.org/ Or they could give up to do a bette

I think more complex stuff might be written under those circumstances: https://www.redox-os.org/ https://www.redox-os.org/ Or they could give up to do a better architecture instead for damage containment with interface checks on potentially-malicious input: http://hypervisor.org/ http://hypervisor.org/ https://genode.org/about/index https://genode.org/about/index http://www.perseus-os.org/content/pages/Architecture.htm http://www.perseus-os.org/content/pages/Architecture.htm Such architectures have been commercially deployed in embedded, mobile, and desktops for quite a while. Earliest one I remember still supported was about 2005 for x86 desktops. All by companies or CompSci groups much smaller than VMware in labor and budget simply applying methods that worked in the past in high-assurance security. Cutting assurance down where complexity or budget demanded but only where it was necessary. These big, mainstream companies cut it way down for reasons of profit maximization of existing market share. Then they end up at Pwn2Own or their customers on breach lists.