You absolutely can have (C) without widespread (A), you just need to limit the audience that gets the tools, and in fact the big labs are already engaging in (C) in collaboration with the government and vendors of critical software.

That you don't have access to (C) to harden your blog is a non-issue from a societal perspective, hardening the software that our infrastructure relies on first is simply more important.