I've found the book "Code Complete" to be be very useful (https://en.wikipedia.org/wiki/Code_Complete). The advice goes beyond the hype of the year, and I've found it applicable over multiple decades. Any technical book that is relevant over multiple has got to be onto something.
It looks like this echo program is subject to the same general flaw that was in polkit before the vulnerability was patched (i.e. assuming argc > 0). After a quick look, FreeBSD's echo is also broken. And while I can't think of a way this could lead to an exploit (as echo isn't setuid), it lacks the proper sanity checks by being slightly too "minimal".