In fairness, PHP simply replaces one type of lack-of-safety with another. C does not assume null, 0, "", "0", and false or all the same thing, something PHP does because... reasons. If PHP actually implemented mandatory type safety, PHP would be no worse than Python, and the rewritten code running under the new PHP would have most of the security issues fixed.
Rust's spec... do bear in mind there's at least one project out there that's implementing an independent version of Rust. You kind of need multiple implementations for a programming language to have one. If you look at most of the programming languages we deal with every day, relatively few have a formal spec that isn't "Whatever the only implementation of this does". I'm not arguing that's good, far from it, but it's apparently not a barrier.
If I had to criticize Rust these days, I'd say the fact its standard library is bare and you're forced to rely upon third party modules ("crates") that aren't audited or in any way curated for basic functionality is pretty fucking dumb. It completely undermines the entire point of the language, that it's supposed to be safe to use. We know from the XZ backdoor that you can't trust third party code that way, and it's only a matter of time before a malicious actor attacks one of the bigger crates - perhaps via a dependency - and does the same thing.
To me, Rust having a standard library comparable to, say, Java's is more important than it having a written specification.