It's a nice thought, don't get me wrong, but it's hard enough to convince people to add `-fsanitize=...` to their compiler flags. An entire separate static analysis tool with its own learning curve (and its own set of idiosyncrasies) doesn't really qualify for "bare minimum" IMO.
https://www.eff.org/deeplinks/2023/05/eus-proposed-cyber-res...
The problem with developers that don't do consulting is that they have no idea how each hour of their work relates to product development costs.
In Germany, services companies are already required to provide security fixes free of charge and warranties.
Someone has to pay those hours.
It is no accident that Google, Apple, Microsoft always mention increasing costs with bug fixes, when pushing for writing new code in safer languages.