Earlier quoted context omitted.
Major OS vendors have added loads of hardening to their C compilers. Not bounds checking specifically (because even if the overhead was only 20% that would be too high) but tons of other stuff such as: stack canaries, control flow integrity, hardened string functions, ASLR, zeroing uninitialized auto variables, forced warnings, linker hardening. These are added as standard in all decent Linux distros today. Probably…
Kind of, because to this day it has been a quixotic battle for devs to use them at scale. Those OS vendors rather push for Swift, Java/Kotlin, C#, and Rust instead. Alongside ARM MTE, Pluton, SPARC ADI. Also, all those hardening measures and lack of bounds checking could have been solved with WG14 papers, nowhere to be found. C isn't set in stone.
Fedora will soon implement shadow stacks across the entire C codebase: https://discussion.fedoraproject.org/t/f45-change-proposal-e...