AT&T made Cyclone as C replacement, GCC has an extension for decades, MSVC++ has had pointer coherency debug libraries, SPARC has hardware validation for pointers.

There are many other examples of people trying to band aid and improve C's security history.

The biggest problem is that the developers that are supposed to actually adopt those practices don't really care, because performance trumps security.

Those that actually care end up moving to C++, or some other language, so we end up with this selection bias.

Thankfully they are being forced to change, as being 100% connected to the Internet does wonders to security.