To your point 3, i don't think it's too controversial, some tools are absolutely ok being written in c like all the core-utils, but a monolithic kernel, written in c is probably the biggest problem:

https://www.cvedetails.com/product/47/Linux-Linux-Kernel.htm...