One would think the same of C, where exploits trace all the way back to Morris worm in 1988, that is 36 years of thinking the problem are the developers, not the language, with new projects being started every day still.

At least C++ has mechanisms to write safer code, provided one makes use of them, even if still there are issues.

To use a modern example renaming the JavaScript file extension to a Typescript one, only gets you so far.

Then one can make use of Typescript's type system, or switch to Elm to the next level.