There was an article from Microsoft on why they're adopting Rust that was posted a little bit ago. The gist of it is that even with a skilled staff, 70% of their CVEs were due to memory errors.
70% of CVEs are C/C++, because those bugs need to be fixed and important things run on C/C++.
It is an entirely useless metric.
> 70% of CVEs are C/C++, because those bugs need to be fixed and important things run on C/C++.
You mis-understood the statistic; the statistic was not "70% of CVEs come from C and C++", the statistic was "70% of bugs come from memory safety issues." They did not classify by language.