Segmentation was expensive (loading an 80286 segment register was very slow and the segment table was impractically small) but could express "offsets between 0 and 42 are valid". Paging is much coarser and suffers from false negatives, because x[y] might accidentally walk off the end of x, skip a guard page, and land on a mapped page from another object.

Not quite true: There would not exist exploitable buffer overflows if that was the case.