To boil down a long thread:

1) systemd is the default, and integrates a lot of features, but consequently has a large attack surface;

2) there are more minimal init systems (like https://smarden.org/runit/ - pretty interesting) that may be easier to audit and have comparable functionality.

I'm not sure I'm willing to commit the required time/focus to switch out systemd with runit, but I'm glad to know there are good options.

Thanks, all, for the discussion,

../Dave