> Coverity is expensive and majority of software people use are open-source which don't make use of it(hence all the CVEs).

It's definitely an area where the closed source tools are ahead of the OSS alternatives, but there are open source (and free closed source) alternatives to Coverity. PVS Studio, for example, has a free download: https://www.viva64.com/en/pvs-studio/

> As an end user running a server, i very much care about whether my web server has vulnerabilities. And the promise about safety is not vague, it has clearly defined semantics.

You say that, yet you're still running a ton of software written in C and C++.