The strain from the amount of bugs is visible in bug bounty programs. A run on many targets will turn up exploits, but if you report them on any of the platforms a majority are instantly marked duplicate. It's so overloaded that companies are shutting down their programs from the volume of reports.

Anthropic is arguing for formal verification [0]. This is an excellent idea on the edge of feasibility, but it's hard to see how this can work for the majority of software that has to adapt rapidly and are so open ended that it's difficult to even conceptualize all the input modes. It's an easy prediction that we will see verification on large trunks of fundamental software in the next few years, and a sub-verification confidence scheme for the software on top of it.

[0] https://www.anthropic.com/research/formal-verification