You'd probably want an alternative libc implementation rather than a compiler flag.

However, calloc everywhere won't save you from smashing the stack or pointer type confusion (a common source of JavaScript exploits). Very rarely is leftover data from freed memory the source of an exploit.

That wouldn't make it safe. It would just make it crash in a different way, and still be vulnerable to exploitation by an attacker.

We have that already. There are still other problems that exist.

If only the very competent people that decided to create Rust had thought of asking you for the solution instead...

Have a little humility.