Let's talk about why compilers and static analysis for a second.

Most companies are paying folks to work on compilers to improve code generation and not looking into other areas (security).
It is only application developers who are pushing for better tooling in those same companies. But that priority message does not get down to the compiler team.

And then when compiler folks implement something (e.g. -Wstringop-overflow, Warray-bounds), application developers complain about them because they were not tested on their applications and provide too many false positives.

Oh did I mention there are also some closed source static analyzers out there which companies are just paying money for. Instead of investing in open source world.

So when things like LLMs come around and can do "static analyze" for cheaper and seemly maybe better than the closed source programs well companies are going to jump on it.

Basically what I am pointing out is the problems with current state of things when it comes to static analyzers.
I don't know anyone who even tries to use clang analyzer and I have not even seen anyone prompting it. On the GCC side it does seem like there is a little more prompting of GCC analyzer and getting open source developers to try it out and report issues and even GSOC projects to improve it. But GCC's analyzer is much newer and does not cover a lot.