Splitting programs into mutually untrusting modules is a plausible alternative to memory safety in programming languages.

Also in a program similar to qmail, memory safety alone is not sufficient, a lot of bugs in sendmail were related to complexity issues.