We should not think in absolutes, but in terms of tools. What risks come with using a certain tool. In your Rust example, using C is like using a power tool wi

We should not think in absolutes, but in terms of tools. What risks come with using a certain tool. In your Rust example, using C is like using a power tool without any safety measures. That doesn't mean that you are going to get hurt, but there is an expectation that a sizable fraction of users of such tools will get hurt. Rust is then the same tool with safety measures. Of course it is still a power tool, you can get hurt. But the chances of that happening during normal operation is a lot lower. I think xz is a good example where open source happened to work as intended. Somebody noticed something weird, alerted and other people could quickly identify what other software might have the same problem.