Redis has RCE exploits which would not exist in a memory safe language [1]. QMail had an RCE as well[2] and DJBDNS has had a security bug which would not have occurred in a memory safe languages [3]. The linux kernel has had an incredible amount of memory bugs over the years. The software you mentioned does much, much better then the average C written code. But it still has had issues with memory. So in fact all your examples prove my point.

[1] https://github.com/jas502n/Redis-RCE

[2] https://www.qualys.com/2020/05/19/cve-2005-1513/remote-code-...

[3] https://web.archive.org/web/20190126114638/http://article.gm...

The reason they're built in C is legacy and the fact that Rust hasn't been around all that long.

That's only true on Linux and other systems where the kernel has been written in C. On some platforms the kernel provides no backwards compatibility guarantees and that means backwards compatibility is handled by libc. This means C is enshrined into the platform and often the path of least resistance.

There was also a pure Rust Wayland binding that failed because Wayland assumes that you are using C semantics which made it hard to provide a safe interface for Rust that was also convenient.

Yes, and that good reason was that Rust did not exist.