The CVE trend for systemd is worrisome as well:

https://www.cvedetails.com/product/38088/Freedesktop-Systemd...

Disappointing that an init system is on the network at all.

That really isn't systemd's fault. Software needs to manage the efi variables, so systemd mounts efivarfs writable.

What software actually needs to repeatedly write to these variables? Systemd itself does, but there was absolutely a world before having this option on by default. Grub and such can just unmount after they are done.