There were dozens of other init systems that, like systemd, wasn't a shell script.

What set systemd apart is the collection of tightly integrated utilities such as a dns resolver, sntp client, core dump handler, rpc-like api linking to complex libraries in the hot path and so on and so forth that has been a constant stream of security exploits for over a decade now.

This is a case where the critics were proven to be right. Complexity increases the cognitive burden.