That doesn't really help you when the platform you run on be it a browser or a virtual machine is written in C/C++ which by implication can be exposed to the same security flaws if/when they utilize unsafe design patterns or idioms. So, all you've done is pass the buck onto Servo/Gecko/Safari. The reality is that you can't make an argument that's ironclad in favor of forcing JS to become the new C. Let JS do it's wonders for the web and let C/C++ and other languages that have great native application tools do their wonders for the desktop?