Aren't most or nearly all of the Java exploits related to running sandboxed code? Instead of relying on a code security model, use containers or other external

Aren't most or nearly all of the Java exploits related to running sandboxed code? Instead of relying on a code security model, use containers or other external permission systems. For Microsoft, all the RCE were either use of C/++ or loading .Net into partially trusted scopes (like a browser). I think Rust would have perhaps fixed a few of the managed runtime vulnerabilities, but probably not the majority. Forget sandboxing and you're done.