There are several safe dialects of C. The issue is that almost no one is using them and they're not about to start to either.

A lot of infrastructure software has not been built with security in mind, but the game has changed, and this old C software is getting eviscerated.

If one looks at the fixes for these buffer overflows in dnsmasq, no other conclusion can be drawn except that holes are plugged in a leaky sieve. This could work for software that's done, eventually. But if something's under maintenance, using plain C is security suicide.