Simple bugs can be spotted by simple auditing, while complicated problems require indepth analysis which most people or groups are not willing to invest their time in. I think that education can help somewhat. One of the OpenBSD developers teaches an introductory C language course in a university environment. Halfway through the course, the students are shown what a buffer overflow is, how to build a stack-smashing egg. Compilers can only help with some of these problems.
Compilers are limited to doing static analysis.
Tools like Purify or other memory use checkers can only do check the dynamic flow of the program as it was tested. In the end, the programmer has to be skilled enough to make sure he does not make errors. See our manual page . Most system administrators use SSH on their servers. For years now, I've tried to talk to people who use OpenBSD, to see what their next big need was.