As if Devian has had more security reviews than systemd?
You are comparing apples and oranges.
systemd replaces several components you would typically find as core components (multiple packages) which everything in a distro is built and depend upon, init-scripts being no exception.
Or at least it does if you present the criticism that systemd is too big.
Make up your mind: either systemd is not such a big monolith or it does in fact make sense to compare it to a minimal Linux distro.
You can’t have it both ways.
2) Every "core component" in any system, "minimal" or otherwise, will indeed have had more security review than the systemd code base.
3) Pid 1 - Sponsored by NSA and DoD vis a vis Redhat defense contracts.