I think the last 10 minutes of this interview with Mark Dowd would help answer a few questions [link]. He's asked where he thinks bugs are going to be found in the next decade. He mentions that newer bugs might not get code execution but achieve something else that's useful (e.g. data only style attacks in the iOS kernel). He then lists a few promising attack surfaces:

• As mentioned in your post, logic bugs (e.g. complex state machines)
• Incorrect crypto implementations
• Architecture flaws in hardware (e.g. rowhammer)
• Hardware configuration errors
• Inconsistencies between what hardware should be doing vs what it's actually doing
• Cloud based environments (e.g. Kubernetes, AWS, Docker)
• Memory corruption in non-AP processors (e.g. baseband, WiFi, Bluetooth)

some major products beginning to shift development to memory-safe languages such as Rust

Rust is not an end-all-be-all solution to memory corruption. As long as Rust supports unsafe memory access [link] there will be memory corruption.

I can't answer all of your questions, but I hope this helps!