Microsoft: 70 percent of all security bugs are memory safety issues
https://zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/…
Or accept using reference counting and dynamic mutability checks. Thread local reference counting is quite cheap, especially with default move semantics rather than implicitly adding new owners. People greatly exaggerate how often Rc/Weak and RefCell aren't a viable option.
It's true that they can add a bit of overhead that wouldn't be there in some cases if you were managing the owning and non-owning references by hand and it can be fairly verbose, but it's a viable option. Rc<T> is quite lightweight, nothing like the heavyweight C++ shared_ptr.