But "buckle down and own it" doesn't actually prevent vulns in any sort of systematic way.

And I assure you that, despite the memes, code health efforts do end up with promos here. The org responsible for third_party and large scale code health had above average promo rates for ages.