It's a shame because in other languages, if there's a bug in my program which goes uncaught, it won't create a massive security vulnerability or a segfault.
You can protect against that by running your vulnerable program in a VM without large performance loss. However, you cannot easily bring your heavily-checked/cache-inefficient/no-inlining Java/Javascript/Python program up to the same C/C++ speed.
This is not a dig against these languages, rather a justification why people are still using C/C++.
Valgrind can only catch bugs that are exposed while the program is running under it. In most cases (when you have a good testsuite), this is sufficient. However, especially in the case of security vulnerabilities, you might have a bug that is only exposed on specific or malformed input that non of your testsuites check for. For example, if you are parsing input from an untrusted source, and that input has a length prefixed field. Unless your testsuite includes a message whose length prefix is longer than the actual length, Valgrind will not tell you that you will potentially overflow, because you do not do so in any of your tests.
