What lessons can we learn from banging our heads on the wall? (No, "don't bang your head on the wall" doesn't count.)
Basically you got it completely backwards. The typical native app (which is not Rust or Java but C/C++/Obj-C, etc) only keeps the unsafe part of Electron, and even drops the sandbox (whose holes can always be patched, but total absense cannot).
It is very disingenuous to say that other native apps keep the unsafe parts; there are no such parts at all.
It should be telling that Microsoft, in one of their most successful products of late, have punched an RCE sized hole in that sandbox unwittingly.
E.g. we can drop Exchange for email for a safe alternative like Sendmail.
Do they? This is just from last month: https://www.zdnet.com/article/google-patches-second-chrome-z...
>You brought open source and - totally unrelated - sendmail into it.
No, you brought the totally unrelated "Avoid Microsoft for stuff that is important, and don't install their software on your machines if you can help it." as if Microsoft is the only place to ever had a RCE...
As for bringing in unrelated stuff, no that was still within the context of Microsoft's meeting software. It was someone else that brought in the OS.