What's to get? It's an unsupported claim with substantial counterexamples in the form of every large C++ project. If everyone in the world gets RAII wrong then it doesn't matter what it's theoretically capable of.
Apache/nginx don't exist,
Chrome/V8 don't exist,
Firefox doesn't exist,
GCC/Clang don't exist,
MySQL doesn't exist,
TensorFlow doesn't exist,
VLC doesn't exist,
and the list goes on and on ...
All software has bugs.
Is this supposed to be news?
* Sorta, for command-line injection you have to know the way the command you are using processes flags and environmental variables in order to know that the filtering you are doing will work. It is absolutely better to use a library instead if you can get away with it.