If such tooling was available, why isn't it being used by the projects for whom it matters

Oh, my dear, sweet, summer child. Welcome to capitalism, and the rule of "good enough." Static code analysis tools cost money, and take time to run. I've yet to work at a company that didn't have a documented process for entirely bypassing QA in urgent situations; although, when I contracted with the USFS, they were much more reluctant to cut corners - that was under a Democrat president; when Republicans took charge, they cut a lot of things, including software quality controls.

But - as I said - I haven't touched C in decades, so I can't refute your claim that such tools don't exist.