Yes, this is an accurate assessment from what I've seen.
> And to run it locally you need access to dev versions of all of them.
In my experience, no. If the runtime never needs to access it because you're only doing development related to datastore A, it shouldn't fall over just because you haven't configured datastore B. Lots of easy ways to either skip this in the runtime or have a mocked interface.
> And when there’s a security vulnerability in your comment system your tape library gets wiped.
This one really depends but I think can be an accurate criticism of many systems. It's most true, I think, when you're at an in-between scale where you're big enough to be a target but haven't yet gotten big enough to afford more dedicated security testing at an application code level.