And yet, look at all the billions (trillions?) of lines of code in the world which do not have a horrible security flaw. Heartbleed is notable because of its rarity. OpenSSL is over 500,000 lines of C, written by 500 contributors, and somehow it generally works pretty well.

Maybe the phrase "a decent programmer would never" unfairly assigns blame to an individual's skill, but I think it would be fair to say that the programmers who designed and implemented these bugs were not doing decent work on the day that they made these mistakes.

If our standards for C programmers don't include bounds checking of array access, what exactly do they include?