Not just memory leaks... all the recent hacks/exploits are showing us that even the best people in our field can't write secure code in C/C++. You can reduce your attack surface substantially by using a language like Rust.
Was OpenSSL secure when it was originally written in X lines of code? Very likely.
Is it feasible to expect it to be secure now that it's X^Y lines of code, when a large class of bugs can exist in any line of code? No.
That's what 15 years of an evolving codebase has taught us. Which is reasonable, given that a lot of open source projects came into existence in the mid-90s. Inculcate lesson, design language for next 15 years. Not that radical.
Answer A is "Yes, bugs come from bad development practices or unskilled programmers."
Answer B is "No, there are fundamental issues with the language that make it unreasonable to expect a secure product."
In other words, are the primary sources of bugs programmers or the ways the language forces them to interface with it?