>If the developer doesn't remember to do it when making changes, then the code reviewer can catch it and enforce it.

They can. Just after correcting all the buffer overflows and before fixing all the use-after-frees. Then the comments can be consumed by all the other teams with the discipline and culture to avoid writing bugs for all time.