Many decades of work has demonstrated fairly clearly that it is not feasible to simply demand that people write secure code. "Just write it correctly" also does

Many decades of work has demonstrated fairly clearly that it is not feasible to simply demand that people write secure code. "Just write it correctly" also does not help people who are starting at giant piles of C++ code that is a major security risk but also don't want to rewrite from scratch.