You’re missing a TON of history here. Like udev being a dependency to all those projects AND systemd, which led to systemd adding it to their project. Really it could be said that udev is the critical component here.
As you mentioned networkmanager, you clearly know that many popular distros use that rather than systemd-networkd.
Grub2 is by far the most popular boot loader, so far ahead that it’s not even worth considering others. Grub has had several major issues, every distro uses it, why not pick on grub as the risk?
Did you have these same concerns about sysvinit? About the various distro network scripts? What about libc? Good god if there’s a problem with libc we’re all in deep trouble.
Yes, code has bugs. But New code has new bugs (ironically an argument previously used against systemd). Whatever you replace these components with will be just as likely to have a critical vulnerability, but far fewer maintainers and resources to fix it. Systemd has simplified and improved features of so many parts of Linux that it’s funny to see how vehemently people argued against it. Feel free to disable any parts you don’t need, but I think you’re missing 20 years of painful history that led us here.
Only now? It’s been two years of this and now they’ve had too much? No partial credit should be given for people that continued to participate when it was clear what was happening.