I agree but I also see the counterpoint: a further abstraction layer (or VM) between language and iron can make it more difficult to identify abuses / edge cases, which is where security holes naturally hide. C compilers are very well-understood at this point, they are "the devil you know" so to speak.