Of course, it's not necessary to use a language where "Give control of your phone to remote attackers" is one of the possibilities at all.

General purpose languages, whether that's something like C or Rust or even Javascript are not the appropriate tool. Turing Completeness is a bad idea from a security point of view, not a wonderful feature.