I don't think it's enough. Java without null would still have Log4Shell. The current model where any piece of code can do anything it likes needs to be abandone

I don't think it's enough. Java without null would still have Log4Shell. The current model where any piece of code can do anything it likes needs to be abandoned before we can expect any kind of security from our systems.