In Debian, bash is an essential package. You can assume it's always installed.

Not necessarily, imagine for example an embedded OS with only dash or busybox based on Debian.

Also, even with bash installed, bash doesn't always behave like sh does.

A common example is echo:

With /bin/sh on an OpenBSD:

>>>

kakwa@openbsd ~ sh -c 'echo "print\n"'

print

<new line>

>>>

With /bin/dash (aka /bin/sh on Debian)

>>>

kakwa@debian dash -c 'echo "print\n"'

print

<new line>

>>>

This is consistent so far.

But, now, with /bin/bash

>>>

kakwa@debian ~ » bash -c 'echo "print\n"'

print\n

>>>

That's why I tend to use printf more than echo in my shell scripts.

Also, I'm not a big fan of what RHEL/CentOS/Fedora does symlinking /bin/sh and /bin/bash. It blurs the line between bash and sh, which results a lot of scripts with a /bin/sh shebang containing bashism.

OK, fine, then don't add it to the Depends field. But don't replace randomly things with a symlink to bash just because it's installed. If the scripts fail because /bin/sh is not bash, update your fsckin' broken shee-bang line.

You can make assumptions like that if the consequences are not serious. In this case boot fails next time if your assumption is wrong.

"Essential" is not some arbitrary assumption, but a term of art specific to Debian Policy, and a flag applied to specific packages:

Essential is defined as the minimal set of functionality that must be available and usable on the system at all times, even when packages are in the “Unpacked” state. Packages are tagged essential for a system using the Essential control field. The format of the Essential control field is described in Essential.

https://www.debian.org/doc/debian-policy/#essential-packages

Diversions are addressed in 3.9: https://www.debian.org/doc/debian-policy/#maintainer-scripts

Debian Policy, generally, tells package maintainers, not users, what they may or may not do. Several classes of conflict are listed in the document; Microsoft's scrips violate multiple requirements.

The goal and result of this ststem, arrived at over 21 years collaborative development (Policy was first published in August 1996) is a system which provides well over 60,000 packages and behaves surprisingly robustly from the user-administrator's perspective. Which is to say, there are few surprises.

Microsoft have violated multiple Policy requirements. This is considered a release-critical bug in distro packages for very good reasons.