The author is mistaken about the perceived lack of research into alternatives.

We know how to write secure C/C++ code. The methods are very expensive and don't scale to large engineering teams.

Government agencies as well as large companies - including Microsoft and Google - have researched this very subject for decades. The problem is that even very small probabilities become a significant issue at scale.