Brew update/upgrade is very cve aware.

You can be very CVE aware and still out of date, and brew is plenty out of date. It's managed to become significantly less useful as it becomes increasingly opinionated. At this point it feels downright systemd like with its own launchd wrapper.

BTW compiling ffmpeg with the current version of libx265 (well, current within a few years) doubles the encoding performance on my M2 Pro.

  Zsh is in base. Unlearning bash-isms is good.

Zsh is in the base system due to licensing (not technical) issues, just like UW pico. Usable history search and text editing trump faffing about with colorful autocomplete nonsense. At best the macos command line is useful for boostrapping a useful command line environment.

I almost forgot… sqlite. The bundled version is out of date and/or buggy. No foreign key constraints, no extensions, no strict tables, no thanks.