Large parts of the OS and services like binder DEFINE memory safety. They twiddle the bits to setup the MMU, as well as the functions and data structures for the allocator/etc. Binder, as I understand, is an interface that accepts internal pointers.

There is no automatic memory safety from a language like Rust here. It's not so simple.

Now, perhaps some part of the system could be defined in a memory safe language. That might be good. But not this part.