>If you're in mainland China and the authorities decide they need to confiscate your phone, you're already fscked.
Funny how you specifically mention China, as if it worked differently in USA - the country where you can get four years of jail time for talking back to police.
Google, being US-based company, is legally obliged to provide all the data they have to three letter agencies, without any real oversight. They can’t refuse even if they wanted.
Indeed, you need the whole stack. However, the (non-temporal) memory safety alone is still quite easy to get - the compiler will take care of it, as a programmer you just need to make sure your code doesn't get in the way by eg manually stashing pointers into non-pointer types. It's been demonstrated on large, real-world code bases, such as FreeBSD and PostgreSQL.
(Disclaimer: been there, done that, part of the CHERI team)