> So no. Nobody can write safe C. Not hobbyists, and not "those evil corporations"

There's no fundamental reason why all the checks applied by say, a Rust compiler, couldn't be applied to a piece of C code. Or checks that go well beyond that.

Tools exist to produce extremely reliable code (or even proven-correct code) for a number of languages.

But chances are those tools aren't used to the extent they could be. Or differences in developer culture on different projects. Some PHP web developer will (on average) have different resources, priorities & work ethics than say, someone working on avionics software.

If AI, advanced tool, or a security researcher can find a bug in existing code, then (at least in theory) same bug could have been found before it hit a repository.

But no... push "release", fix issues afterwards when reported. Gotta have developer velocity, right?

Imho it's more a choice rather than "can't write safe code in X".

If you don't believe that: pick a random open source project, and go through some changelogs. Feature introduced in version X, reverted in version X+1 because it broke existing stuff. Feature removed because hadn't-been-working-for-years-anyway. Code added to do X, but no.. doesn't do X, just the scaffolding to do X in next version. Code worked fine & passed tests on system A, but found to be needing a byte-swap on other-endian platform B.

Etc, etc, etc. There's just so much code out there that was broken on day 1. And not rarely known to be so, but released anyway.