We observe very clearly that teams consistently fail to write vuln-free C applications of any meaningful technical or organizational complexity. Following various guidelines empirically does not solve the problem.

It really doesn't. After all, many (most?) other languages like Java and JavaScript are implemented primarily in C and/or C++.

Where it gets deserved opprobrium is that it has no memory safety features, and thus inherently contributes to gobs of security vulnerabilities, and there are safer alternatives now, like Rust.

C is basically "portable assembly", and it's rarely the right tool for the job these days.

Can only patch so many buffer overflows, off-by-one errors, format string vulnerabilities, integer overflows, race conditions, use-after-free errors, etc, before it gets to be a bit tiring. Safer alternatives exist.