That is exactly the reason why Google is pushing for wide adoption of hardware memory tagging as the ultimate solution to fix that C and C++ code, because the dead corpses from battle testing have proven it is not enough.

https://source.android.com/devices/tech/debug/tagged-pointer...

https://security.googleblog.com/2019/08/adopting-arm-memory-...

https://threatpost.com/google-arm-android-bugs-memory-taggin...

https://source.android.com/devices/tech/debug/hwasan

Google also paid for the effort to remove C99's VLAs from the Linux kernel.

https://www.phoronix.com/scan.php?page=news_item&px=Linux-Ki...

Google is also the company that started the effort to adopt Rust in the Linux kernel.

https://security.googleblog.com/2021/04/rust-in-linux-kernel...

So they definitely know how much money it costs them to keep C and C++ around, and are taking actions to reduce that monetary cost related to fixing security bugs.

On the other hand, they just introduced the Android Game Development Kit, with C and C++ APIs.

https://developer.android.com/games/agdk