“If you come across such a project, there’s a good chance you can find bugs statically just by using this baseline.”
C compilers ship with warnings tuned to stay quiet, and -Wall does not turn on all warnings. Wellons calls -Wall -Wextra the bare minimum and MSVC’s CRT “security” warnings bogus and irresponsible. Plenty of projects skip even that baseline. The bugs are sitting there, and the compiler would point at them if anyone asked.