“Memory unsafety is the leading cause of vulnerabilities in Android, Chrome, and many other code bases.”
Modern phones run many coprocessors, each with its own firmware, mostly large legacy C and C++. That firmware lacks the security mechanisms standard in higher-level software. Google’s Android team says to write new code in Rust and replace the highest-risk C, like code that parses untrusted input, with thin shims. Every line left in legacy C stays exactly as exploitable as it was.