The C linker of those years only support function names up to 6 characters. That's maybe why the defines try to match their respective function name in 6 char.
MSVC support C11 because it a prerequisite for C++17. The limits are you need to compile in C++, so the very few changes/incompatibilities between C and C++ always bend to the C++ choices.
The preprocessor isn't what people used to have in C99 so some macro still not portable.
Kernel extension already require a special developer certificate. You should explain to Apple what you need it for, then if your are accepted by Apple you get a new signing certificate including kernel Extensions. After that you can do "anything".
With the notarized every app will be needed to be scan by Apple before. It's something a lot more painful than Microsoft Windows Defender which do the same (first launch of unknown app) for every app and maintained a worldwide database of signature of authorised apps.
you could ask the same question for every os. And none choose Rust even the recent like fushia. BTW go ask Linus to switch to Rust I'm waiting for you there.
Quants are maybe math half-god but the bests I worked with are average programmer. Most of them are awful programmers, and it's not a problem as long as their code is only the prototype for cs engineer to implement in a better way.
In large company I worked, everything critical go through active directory. Every user is assigned to group/role. Every Server application have it's own entry as well. Every authorisation is audited (app launch, document access, databases access...). The day someone leave badge goes off, mail and every access are freeze.
On a day to day usage you could revoke some or all access of a user, even just block word or a database instance. I've seen friend blocked at the door one morning because an inquiry was in process on their computer usage (it last 2 weeks and the guy was innocent,it was someone from IT who manually installed/modify unknown system files on his computer).
From security standpoint almost nobody have access to production database. Most of the people work on old snapshot or incomplete extract.
In another company. If you do a request on sensitive database (select * from customer), a security guard come to your office ask you to stay away from keyboard. Then the office manager is called to ensure that your work is legit.