I suspect that’s not the only vulnerability.

I don't understand, what are you referring to? The significant part of the DDL hijacking is a function pointer read/write through the FTS3 "plugins?". If we stop building with FTS3 then the control of DDL hijacking does not pose any known security risk. It is worth examining if this hijacking can do anything special in the context of osquery (vs other usages of querying SQLite DBs) but I don't think that's the case.