If all it takes is one human screw up with 3 lines of code to get full remote execution, you will inevitably get security bugs with that code. A best practices guide will not work, because people will not execute on their best practices %100 of the time.  A language specification or at least a linter will enforce it %100 of the time in a practical comparison. This is why people want to sunset C family languages.