I mean you're not wrong but I'd argue you can get more interesting cve's using a higher more performant language such as c++. Where there are are ways to include CVE 's from C and introduce new ones to each level of your program using inheritance.
Been ages since I had to recompile a Linux kernel to deal with hard real time (via RTAI) but I recall emc2 being a great alternative to all the fussing around recompiling as some one did all the work for that.
I also recall using this resource . Eventually I just made a class for the threads I was using to wrap POSIX and RTAI calls for periodic tasks and chose which was the underlying method on a compiler flag. If I was on my desktop I could proof of concept most things in POSIX and then test on the RTAI machine. If I need to revisit this again I may dust off my old class and add freeRTOS stuff to it so I can prototype on Linux then try to squeeze it on to an esp32.
Umm I hate to point this out but Canada has never operated F-16s. Perhaps some wire got crossed here and they ment F-18s ( Canadians operate a variant of those) or perhaps they mean training in the training plan where they train new pilots In Harvard2s and hawks to prepare for first flights in the f16.
Buy'em now before your tarrifs get ridiculous