Agreed on most of those points. I think everyone agrees that osquery is a nice target, and there has been some professional security auditing performed (see https://yahoo-security.tumblr.com/post/118445868880/osquery-security-audit, for example)