And something like SQLite shows that you can get 100% coverage (as in, every single statement is hit in the tests). That's 100%.
sqlite is bad example, for example features like the FTS tokenizer code (https://research.checkpoint.com/2019/select-code_execution-f...), which were probably paid by commercial requests or sponsors.
That is not to say sqlite does not have 100% coverage, it of course does, but you are building on top of infrastructure which is really really hard to be kept safe.
Rust somehow makes it harder to make certain kinds of bugs, which comes at its own cost.
PS: I don't like or dislike rust, just I have seen the sqlite example being brought a lot, and a lot of people didn't expect sqlite file to be an attack vector :) so nobody is even looking there.
Then again, I don't think that the sanitizers, while great, prevent anywhere close to 98% of the issues either.
"Kills 98% of viruses" is good enough for hand soap, but it's not good enough for the vital infrastructure that basically all software relies on.
Now that we have self-driving cars, rockets, medical devices, etc relying on this infrastructure, I don't think a push towards total provable memory safety is a bad idea.
(Though notice I said "total provable memory safety". If there's a way to get there without a rewrite in Rust, that's preferable a million times over.)