> Lots of CVE's around this in other language SDK's that have been ironed out over the last decade and half

Like what? The only notable one I know of is log4shell. And no one advocates not to use java because of rce. Nor javascript, nor python, nor erlang. Compare with c...