Ada can do that, but C++ arguably makes things even worse than in C: apart from supporting a subset of C's misbehavior, it introduces implicit-by-default converting constructors. Those make API misuse very easy.

Experience in Apple and Microsoft platforms, among others, shows otherwise.

And for info, Android Treble drivers are mostly C++, although Java is also an option.

Ah and Fuchsia is a mix of C++ and Rust at it lower layers.