> std::string::c_str returns the same address as &string[0]

Note that this by itself doesn't imply null-termination, though as you say strings are indeed null-terminated now.

Edit: This is not particularly obvious, but the reason this has nothing to do with allocation or the return value is that the implementation could still leave space for the null terminator, but avoid actually setting it to zero until c_str() is invoked. That would neither affect the returned pointer nor the constant-time guarantee.