Of course, there are plenty of things that are useful in practice that cannot model quicksort, or that would require you to implement stacks and recursion in aw

Of course, there are plenty of things that are useful in practice that cannot model quicksort, or that would require you to implement stacks and recursion in awkward Turing-tarpit ways. There's nothing inherently "unsafe" about a lot of things that guidelines for safety-critical firmware prohibit, either. More importantly, "safe" in the sense of "recursion is not inherently unsafe" is not the same thing at all as "appropriate for safety-critical applications". They can overlap, of course, or not. The point is that you might not need recursion or might even actually want to avoid recursion in the domain claimed for Drakon. Whether it's actually been used in these kinds of applications or not, I have no special knowledge beyond having looked over the Wikipedia articles.