Different kinds of security vulnerabilities have different levels of severity. The ones in HLL tend to be not nearly as bad as the ones that come out of C codebases.

Yes, to your first point. To the second, I'd argue the impact is the not that much different in most cases. Barring horribly mis-configured systems, networked C/C++ applications execute at the local user level so even if you get an exploit going you're SOL unless you have a local privilege escalation vulnerability in the underlying OS. For a web app, most of them are connected to databases and exploiting a vulnerability there usually allows you to either dump user data, or corrupt memory and execute shell code (leaving you with the same situation as the C code). Usual disclaimers apply - these are oversimplifications for casual conversation purposes yada yada.