What about qmail? No one runs qmail and no one is writing new C with that kind of insanely hyperconservative style using only world-class security experts.

And it still wasn't enough. qmail has seen RCEs [0, 1] because DJB didn't consider integer and buffer overflows in-scope for the application.

[0] https://www.guninski.com/where_do_you_want_billg_to_go_today...

[1] https://lwn.net/Articles/820969/

> Why don't they use qmail as an example?

Perhaps because qmail is an anomaly, not Android? To remain relatively bug-free, a sizeable C project seems to require a small team and iron discipline. Unix MTAs are actually pretty good examples. With qmail, for a long time, it was just DJB. Postfix has also fared well, and (AFAIK) has a very small team. Both have been architected to religiously check error conditions and avoid the standard library for structure manipulation.

Android is probably more representative of large C (or C++) projects one may encounter in the wild.

What does bias have to do with empirical evidence? Disprove that than driveling about non-tech stuff.