... no straight thing was ever built. Not even a kernel?
Well, that's not really true. Our own embedded RTOS (now called VirtuosoNext) was formally developed from scratch using Leslie Lamport's TLA+. It has a history before it. VirtuosoNext (previous name was OpenComRTOS) was a 5th generation development. The previous 4th generation (that has roots in Hoare’s CSP) one made it into the open-source Zephyr (after WRS acquired the IP). The issue is less one of using C versus other languages (like ADA, Spark-ADA and RUST). The first domain to tackle is architecture. Monolithic vs. modular. With separation of concerns. That includes semantics. This is where a formal design delivers. The VirtuosoNext kernel is 5 to 10 smaller than it predecessors because it has no duplicated code. It's kBytes vs. Mbytes. It also supports fine-grain space partitioning with real-time fault recovery in microseconds. This is on the technical side. A major issue is market acceptance. Most software done is coding, not engineering. People reuse what they know and often this is what they learned at school. Economic factors are important. Most often people prefer a quick and dirty solution rather than one taking more time but then being more trustworthy. Hence the need for vast third-party libraries and tools (the lack thereof is why Modula-2 failed). We have looked several times to rewrite it in not-C, but in the end the reason to stick to C is the availability of compilers (for embedded targets).