Those aren't static analyzers, they're dynamic analyzers; they only catch issues at runtime.

GCC's -fanalyze, and clang's `--analyze` both run static analyzers.

If this is such a good default, why make me type `-fsanatize=address? Why isn't this the default when not doing "release mode"?

It adds nontrivial runtime cost. It’s also not a perfect mitigation (there are plenty of unsound patterns that ASan, UBSan, and TSan won’t catch).

The obvious answer is that I don't want to pay for these checks at runtime and can catch most of these bugs at test time. There are definitely use cases where that's acceptable.

I meant static analyzers like clang-tidy and cppcheck. `-fanalyze` I suppose is a fair comparison, but `fsanitize` is not since it's not even static

Yes. Both clang and GCC come with static analyzers built in. Clangs supports whole program static analysis.