Since working on #CHERIoT, I've been surprised at how many other potential security problems I can just ignore if I have temporal memory safety that works in the presence of malicious compartments.
If I free an object, I guarantee that nothing else I care about will alias it. Another compartment may have kept a reference, but they either claimed it (and so it counts against their quota) or didn't (in which case its pointer stops working right now).
A whole chunk of the TLS stack can be riddled with TOCTOU bugs and I don't care because the scoped delegation mechanism means that, once a receive call has returned from the TCP/IP stack, I know that the TCP/IP stack can't hold a pointer to it, so the only thing that can mutate the object is the TLS compartment (and it's not actively trying to attack itself), so as long as it doesn't check something in the packet and then mutate it, it's fine: nothing else can, not even untrusted assembly code in the TCP/IP stack.
I guess it's not surprising that it's easier to build secure systems if the hardware and core platform give you a sensible set of core guarantees.
#CHERI