Comment by jacquesm

Exactly. Looking towards the language to keep you safe is essentially client side security, it's the memory model that isn't safe: dumping everything in on executable allows for all kinds of tricks to be performed. Only a micro kernel has with the present architectures the ability to isolate one driver from another in such a way that those drivers can not accidentally or purposefully attack each others address space.

Another advantage is that there is no such thing as a kernel crash, worst case you get a device driver that needs restarting. The whole loadable module model is broken by design and replicating it in Rust isn't going to solve that particular problem (and it isn't one that Rust is trying to solve).