Let me give a better example. Say ls or cat has a buffer overflow or some other issue, and you are a web admin. Users can upload text files to your server. You want to see the contents of one, you ls the directory and cat the file contents. You are relying on ls and cat to both be fine with handling untrusted data (to be clear cat-ing untrusted data is a bad idea period, but you get the idea). At the end of the day coreutils are installed EVERYWHERE. In almost every container (unless you are smart enough to be running a distroless container) and every Linux OS on the planet. A vulnerability there is a huge issue. Hence wanting to reduce the attack surface. Plus the coreutils are a well documented problem before moving on to their components of the OS. You saw the same with rust in the kernel, the first things that got written in rust were practically useless and would have been just fine in c, but as we go there is more and more benefit.

Plus the fact that uutils is a much nicer codebase to get new devs working with than a c codebase, let alone what I’m sure is a c99 codebase with lots of unique internal APIs.