>Sadly we cannot remove it from standard-C yet AFAI Know.

The C standard definitively removed this function in 2011 from its specification.

gets() was deprecated in C++11, removed entirely in C++14, and also removed in C11. So while it should have been removed in 1989, it did finally get done over a decade ago.

Memory unsafety in C/C++ is a big portion of security issues, but it's not everything there is.