About a year ago, Stroustrup wrote a similar response[0] to a similar statement from the NSA[1].
I wasn't really convinced and am more in agreement with this response to Stroustrup[2] from an embedded Linux developer. To quote from near the end of their response to Stroustrup:
> In the meantime, it is unfair for Dr. Stroustrup to call safe programming languages novelties or to pretend that C++ isn’t already far behind the times on this. This was already an important criticism of C++ decades ago, when Java first came out in the 90’s and was referred to as a “managed programming language.”
I'm not really buying that C++ is really all that commonly safe when we have stats like these[3]:
> A recent study found that 60-70% of vulnerabilities in iOS and macOS are memory safety vulnerabilities. Microsoft estimates that 70% of all vulnerabilities in their products over the last decade have been memory safety issues. Google estimated that 90% of Android vulnerabilities are memory safety issues. An analysis of 0-days that were discovered being exploited in the wild found that more than 80% of the exploited vulnerabilities were memory safety issues 1.
> The Slammer worm from 2003 was a buffer overflow (out-of-bounds write). So was WannaCry (out-of-bounds write). The Trident exploit against iPhones used three different memory safety vulnerabilities (two use-after-frees and an out-of-bounds read). HeartBleed was a memory safety problem (out-of-bounds read). Stagefright on Android too (out-of-bounds writes). The Ghost vulnerability in glibc? You betcha (out-of-bounds write).
[0]: https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2023/p27...
[1]: https://media.defense.gov/2022/Nov/10/2003112742/-1/-1/0/CSI...
[2]: https://www.thecodedmessage.com/posts/stroustrup-response/
[3]: https://www.memorysafety.org/docs/memory-safety/