safety isn't achieved by adding capabilities, but by omitting capabilities. the hard part is how to avoid omitting necessary capabilities

> In particular I/O is something that lots of language have as part of the language and C doesn't. So it is in many ways obvious why C a lot smaller than PL/I without losing any power.

that's not why; often obvious things are wrong