Hell, it seems that only as systemd people started talking up nspawn as a way to do containers did the business side sit up and take notice. Before then it was mostly considered a bikesheding runaround between nerds.
Yeah yeah, Gnome can work without logind. But doing so is not easy and require ongoing patches as new versions of Gnome rolls out.
And Gnome is THE gorilla in the Linux DE world.
i also like journald, logging is a pleasure now, even to syslog, and other syslog servers.
well what I don't get is timedatectl i.e systemd-timesync and many more. they are mostly not needed for init itself and already had a really really good counterpart.
I haven't seen many vulnerabilities in the PID 1 part of systemd that concerned me. The last vuln I recall was the UID parsing issue, which isn't really exploitable.
The systemd-resolved vuln was pretty bad, but that's an optional component that I've never used anyway. (It's not used by default on Debian.)