Not at all surprising, but it's not like Rust (and others like it) are going to be a silver bullet against this.
Any complex enough program running on a stored-program computer (where code is data and data is code) will be vulnerable.
You can reduce the attack surface, but never eliminate it.
You can reduce the attack surface, but never eliminate it.