Indeed, except when you get into the critical software realm. Firmware for pacemakers, avionics etc. There are respective ISO's/regulations and enforcement bodies.

I wonder if that ever expands to traditional software when the stakes and blast radius increase significantly with time.