I don't think this is necessarily wrong, but I wonder if there's a sampling bias here: the really good memory corruption bugs might tend to not be discovered fo

I don't think this is necessarily wrong, but I wonder if there's a sampling bias here: the really good memory corruption bugs might tend to not be discovered for years, or have small variants that keep giving for years (because they're in legacy parts of the codebase, and the team lacks institutional knowledge to make comprehensive fixes). (Put another way: I entirely believe that rewriting old components in Rust might introduce more bugs, but might still be a net win in terms of decreasing vulnerability researcher value: 100 silly panicking overflow bugs are preferable to one "oops, underflowed the pointer and now the attacker has arb R/W at an address of their choice" bug.)