> This one is totally obvious but has a stunning number of ways you can fail to adhere to it, some of which look reasonable at first blush

If memory safety is actually important to you, there's now an actual practical solution: SaferCPlusPlus[1].

A tool to automatically retrofit memory safety to existing C/C++ code is in early development (but resources are limited so it might be a while).

[1] shameless plug: https://github.com/duneroadrunner/SaferCPlusPlus