Changing defaults is hard and I can understand why compiler writers would be reluctant:
Many of the suggested warnings will reject valid-but-marginal code that you might not have time to rewrite (or might not be able to, eg. it's in an external library that you don't understand well).
Sanitisers and static analysers very often complain about quite valid code that doesn't need to be fixed at all.
Some hardening flags cause significant performance regressions.
Who is to say that -g3 is the best option? It causes huge binaries to be generated which might not be useful if you have other means to debug the code or can't/don't use gdb.
Many of the suggested warnings will reject valid-but-marginal code that you might not have time to rewrite (or might not be able to, eg. it's in an external library that you don't understand well).
Sanitisers and static analysers very often complain about quite valid code that doesn't need to be fixed at all.
Some hardening flags cause significant performance regressions.
Who is to say that -g3 is the best option? It causes huge binaries to be generated which might not be useful if you have other means to debug the code or can't/don't use gdb.