Overall safety matters. Memory safety is just one factor. Log4Shell happened in Java, a GC language without pointer arithmetic.
Presence of worse bugs won't make memory bugs disappear.
Is how this kind of arguments always get received by security folks.