If it truly was "insanely difficult", we would have almost no products. Clearly that's not the case. Of course most products are highly imperfect, but here we are.

And not all code is the same. To a huge degree - most things are pretty straightforward, and the hard stuff is usually a minority of the whole.

Correct code might not be sufficiently tested, it might waste memory, it might do dumb things with the wrong data structures, it might be terribly factored, it might be commented in sanskrit - and yet it can still be "correct". Don't muddy the waters by bringing in all these other factors. Those are not correctness, even though it might be something that you (and I) strongly desire, or things that are necessary to ship with. Correctness is not "done".

And I agree that any code released into the wild should be as secure as you can make it. Though a scientist running a sim on their desktop might not be remotely concerned at how secure their fortran code is.