It's not just a systemd thing, all the sandboxing/apppification frameworks (flatpak, snap, etc) heavily rely on dbus as their primary way of communicating with

It's not just a systemd thing, all the sandboxing/apppification frameworks (flatpak, snap, etc) heavily rely on dbus as their primary way of communicating with the sandboxed apps, and are constantly adding new dbus interfaces. It is the biggest and most obvious attack surface for sandbox escapes, and the more opaque dbus is, the harder it is to assess their risks.