... where an error might be fatal.

And its fatality won't change whether it will be an error in assembly or C.

So, we have assembly, hard to read and verify, but with easily verifiable "translator". It takes some labour to get the sources right but once you achive that, you can be sure the machine code is correct.

And we have C, easier to read and verify (and maybe also easier to overlook an error? :-) ), so we can get a perfect source code cheaply; and a "translator" which can introduce its own bugs and you cannot do anything with this (but perhaps take the output of the compiler - which is, what, assembly, but with much less readable machine-generated structure - and check that).

If anybody would ask me, when the stake is as high as human life, I'd choose the first option.

JW