I see a difference when the language doesn't provide mechanisms to enforce program integrity.

With a type safe language, being used alongside isolation mechanisms, I get two layers of protection, at language level and at the sandbox level.

Like Android or ChromeOS do with their managed environments + Linux SE and on Samsung's case Knox.

If the language is unsafe, everything outside the jail might be safe, but the program integrity or the data inside of the container are exposed to the attackers.

If I get RCE in your mail client I read your email. Not letting me persist doesn't help much more.

How does the choice of language prevent that? Sure different languages might make that harder, but I don't know of many that don't allow arbitrary code, written by a random developer, to execute poorly defined HTML parser to possibly exec some hostile code.

There are facilities and standards in most languages to help prevent this, but can you point out why this is not possible in Limbo? I'm not personally familiar with it.

Sure preventing logical errors is hard, but it is already an improvement that typical C errors aren't possible.

Limbo does not support this, but both Java and .NET allow for security control at class and method level, however they tend to be misunderstood by most developers, which don't regularly use such features.