Coverity is expensive and majority of software people use are open-source which don't make use of it(hence all the CVEs).

As an end user running a server, i very much care about whether my web server has vulnerabilities. And the promise about safety is not vague, it has clearly defined semantics.

To comment on your last point, it's seeing some light already, ripgrep is already beating grep in performance and is purely written in rust. And i agree that this is how rust will beat C++(if ever), by writing "better" tools than those already exist.