Java's runtime has had a large number of CVEs in the last few years, so that's probably a decent reason to be concerned.

Nothing...

Only that descrition doesn't include Java

Nothing really, the JVM has a pretty troubled history that would really make me hesitate to call it "safe". It was originally built before anyone gave much thought to security and that fact plauges it to the present day.

Written in C++

Fair point, even log4j was running java code, not literally hijacking the stack or heap.

That being said, I'm poking fun because C and C++ have low level capabilities of which only Rust offers a complete alternative of. Most of everything else is safe because it comes packaged with a garbage collector which affects performance and viability. I think Go technically counts if you set the GC allocation to 0 and use pointers for everything, but might as well use Rust or C at that point.

I guess I'm just complaining out of all the issues ONCD could point out, they went after the very broad "memeory-safe is always better" when most of the people using C and C++ need the performance. They only offered Rust as a potential alternative in the report with nothing else which everyone already knows. Would be nice to see them make a real statement like telling megacorps to stop using unencrypted SCADA on the internet.

Java also made it very accessible to the vast majority of existing Java developers.

Way more Java developers than Objective C developers at the time.

I wasn't a fan of learning Objective C when I started learning just as swift was coming out but too new to use.