If the 70% CVE figure can be interpreted as misleading then that was a failure of wording on my part. The intent behind the short list of CVEs was to refute GP'

If the 70% CVE figure can be interpreted as misleading then that was a failure of wording on my part. The intent behind the short list of CVEs was to refute GP's claim that high-profile open-source kernels no longer suffer from memory safety/management issues, and the 70% CVE figure was just to show that high-profile closed-source software isn't much better. I think that the 70% figure is an appropriate example in that case. Now if you wanted to examine whether Rust programs suffer from fewer memory-related issues, you need to look at more than a few CVEs here and there for both Rust and C/C++ programs. As you pointed out, C/C++ programs are much more prevalent, so looking at the absolute number of CVEs isn't a good comparison. Ideally, one would need to find a Rust and C/C++ implementations of programs with very similar feature sets and look at the various vulnerabilities, such as by looking at fuzzer trophy cases for similar programs and compare how many of the uncovered errors are memory-related.