I don't they are the worst (often hard or impossible to exploit) and also not the most common according to: https://www.cvedetails.com/vulnerabilities-by-types.php (despite likely easy to find).

Memory safety is something which can be solved though, which is what memory safe languages do. Of course, Rust is only an incremental improvement because of unsafe.

The claim was scoped to the organizations that made the claim: Mozilla, Google, and Microsoft independently claimed that around 70% of their security issues were memory safety related, not that every CVE ever filed was that weighted towards one vulnerability class.