There's also no rewriting millions of lines of code. There are a bunch of more realistic approaches, like making compilers much safer by default, sandboxing services, partially microkerneling critical pieces of code, for example: moving network stack out of the kernel and into the userspace with proper security measures, we even already have netmap to begin the process.