You're comparing a programming language's standard library with an application. In the former case, most of the CVEs are pointing out bugs in 'unsafe' implement

You're comparing a programming language's standard library with an application. In the former case, most of the CVEs are pointing out bugs in 'unsafe' implementations of std APIs that result in UB where they should not. In the latter case, the CVEs are mostly pointing out actual exploits that permit privilege escalation. If you applied the standard by which CVEs are created for Rust to C---an apples to apples comparison---then most APIs in libc would have CVEs filed for them and they would be marked as 'wontfix'. It's not at all a direct refutation of the GP's claim.