And both have existing tools to find those bugs that people often just don't use.
Coverity exists. They've got a great product. But it doesn't solve the problem.
I love static analysis. I did my PhD in it. But we'll still be talking about use after free in 2073 if we just try to chase higher K in our analysis implementations.
The main issue is the community sub-culture of not adopting tooling as it isn't perfect 100% of the time.
Many of the C++ security conscious folks end up being polyglot, as this subculture eventually wears one out.
Again, even if not perfect, and doesn't cover all use cases, what about people would actually use something at all?
During that decade, how much time did you spent looking at the human side of the problem instead of what the tools can achive?
My only point is that without a different approach we will continue to have the same problems in 2073.