People were able to kernel panic it, get privilege escalations, and DDoS it. In short, it had the same same issues a C based kernel would get.
It's true that it's still heavily in development and doesn't offer any guarantees whatsoever, but I think that it should be pointed out that just because your language is good, doesn't mean that your end result will be good (and vice-versa, C based kernels like l4 and C based projects like SQLite have been formally verified (at least SQLite was verified after compilation, so they check for undefined language constructs.))