The dial is certainly turned up further than most businesses are accustomed to. But if that business is doing something involving my credit card number, I think the threshold of "too far" ought to be somewhere beyond Rust.
Most security flaws aren't things that can be directly checked by a compiler. There are some, certainly, and it's worth preventing those. But the vast majority is in application logic, which no compiler can protect. Competent programmers working in an expressive language is probably the best defense.
While obviously no type system can prevent all logic errors, an expressive type system is very valuable to avoiding these kinds of errors (in my opinion more valuable than the loss of overall expressiveness types imply, but that debate is a can of worms and YMMV).
I'll disagree here. Most security flaws can be completely avoided by the use of auto-managed resources and a comprehensive type checking. On that order.
Basically the bugs normally claimed to be in application logic, that are mostly uncovered or extraneous corner cases are prime time for compiler verification.
Most security flaws aren't things that can be directly checked by a compiler. There are some, certainly, and it's worth preventing those. But the vast majority is in application logic, which no compiler can protect. Competent programmers working in an expressive language is probably the best defense.