But if "Foo" was composed of unique_ptr (or shared_ptr), then those smart pointers would be nulled out after the std::move (due to the default move constructor)

So again, unless Foo f was composed of "raw pointers", even that kind of code is safe from "use after free" vulnerabilities.