I mean you’re not wrong but I’d argue you can get more interesting cve’s using a higher more performant language such as c++. Where there are are ways to include CVE 's from C and introduce new ones to each level of your program using inheritance.