The question I have is how many Open Source projects use static analysis tools as part of their development process?

Given that the code is publicly available it seems likely that bad actors would be using such tools (both proprietary and open) to find exploits for each release.

I remember Eric Raymond blogging about using Coverity to analyze gpsd but beyond that I don't recall any wider discussion about the issue.