Two actually seems like a lot here. Why would you angle for two and not one? It seems like the latter two (unsafe implementation language and high privilege) are both within the purview of developers. Is it just a case of resource management?
2. Avoiding high privilege often means going out of process, which is challenging on resource-constrained devices.