There will always be one, so "it only takes one" is meaningless and invalid. That leaves less is better than more, and any form of less is as good as any other form of less.
Latest batch of LLM's Linux had 423 vulnerabilities. Out of which 10 were Rust*. Would you prefer more or less CVEs?
But it's like seat belt analogy. It's a helper not a panacea.
* Granted Rust isn't in the entire kernel yet. D
https://security.googleblog.com/2022/12/memory-safe-language...