If this is such a good default, why make me type `-fsanatize=address? Why isn't this the default when not doing "release mode"?

The obvious answer is that I don't want to pay for these checks at runtime and can catch most of these bugs at test time. There are definitely use cases where that's acceptable.

It adds nontrivial runtime cost. It’s also not a perfect mitigation (there are plenty of unsound patterns that ASan, UBSan, and TSan won’t catch).

Good question. How much of a slowdown are you willing to accept on deployed systems?