The Wformat-security flag is common in Debian and Ubuntu systems and is set by default with the current r-rocker (e.g., R CMD config CXX11FLAGS) . But MC-CBN fails to build because

mcem_hcbn.cpp:36:15: warning: format not a string literal and no format arguments [-Wformat-security]

(For the sake of completeness, I just noticed this when trying with rocker/rstudio:4.4.1, but a couple of years ago, with 4.2.0, this did not fail, though I am not sure if MC-CBN's code has change in this line or not over these two years).

(Alternatively, but this is arguably a kludge, one can change the value of CXX11FLAGS right before the call to autoreconf).