High assurance niche taught us both the methods you mentioned (eg NASA) and why this comment is correct. For this one, it&#x27;s because C and C++ codebases often ignore the root cause of so many vulnerabilities in their very design. Too much IT fixes symptoms instead of root cause. That highly assured systems needed immunity to many issues meant the root causes must be prevented. That eliminates use of C and C++ where possible.<p>Such thinking is why MULTICS used PL&#x2F;0, why GEMSOS used Pascal, why Wirth used Modula and Oberon for safer OS&#x27;s, and why Altran-Praxis used Ada&#x2F;SPARK for a CA. Results were better than C (or predecessor) every time. Deal with root cause, symptoms fade away naturally. Solutions like Eiffel and Rust take that philosophy into modern IT.