[staticassertion]

> Google have published a couple high-level Rust blog posts with many graphs and claims, but no raw data or proofs, so they haven’t demonstrated anything.

Don't expect proofs from empirical data. What we have is evidence. Google has published far better evidence, in my view, than "we have this one CVE, here are a bunch of extrapolations".

> By now their claims keep popping up in Rust discussion threads without any critical evaluation,

Irrelevant to me unless you're claiming that I haven't critically evaluated the information for some reason.