As if C++ had a security mindset:

void foo(std::vector<int> &x) { x[4] = 1; }

int main() { std::vector<int> x{ 0, 1, 3, }; foo(x); std::cout << x[4]; }

The difference being that all C++ compilers have an option to enable bounds checking on operator[]().

Additionally, until C++26, the way the standard is written, the legalese doesn't forbid the implementation to do bounds checking.

Now can you please enlighten us how to do the same with C arrays and strings, with bounds checking enabled, and why in 50 years WG14 has completely ignored the problem, including Dennis Ritchie proposal for fat pointers, until the government and industry pressure, and even now, I am quite curious if C2y will really bring any actual improvement.

You can use the bounds sanitizer at least with clang and GCC to get bounds checking for [] on arrays with C and this has been working for a long time. Also the legalese in c never forbid bounds checking, and there were various bound checking compilers already in the past. If you use your own libraries, you can easily do whatever you want anyway.

An answer that authors of cyber security laws are certainly going to be happy with.

I repeated your argument.