People keep saying this, yet undefined behavior sanitizer proves in the real world it isn't an issue most of the time.

Most real world security issues have nothing to do with code. Social engineering breaks more security than memory issues. We are also skewed by many of the fundamental programs are written in C and so there is a lot of value in finding holes.