We should track and fix buffer overflows.

And you’re right, I don’t know all the ways this can be combined with other attacks related to the shell.

But when I design a system the security people at work tell me to assume any bad thing can happen in a user process and design the process isolation and policies to contain it.

Entire categories of attacks (Dos) etc are futile to do anything in user space. Just limit resources and call it a day.