Are you sure about that?
]pwd objc4/runtime/Messengers.subproj ]rg malloc ]
And of course NeXT used objc_msgSend() in the kernel, to good effect, so that's pretty low-level.