The "sysvinit" binary package has had a total of 2 bug reports tagged "security" filed in Debian's bug tracker. That's over the entire history of the package that goes back to at least 2004.

If I extend the search to all packages built from the "sysvinit" source (which includes packages like initscripts and sysvinit-utils), the count increases to 8. (source: https://www.debian.org/Bugs. I'm not linking to exact queries since they take quite some time and HN has a tendency of taking down Debian's bug tracker)

Also crond, atd, and various log manipulation tools that systemd replaces.

It doesn't replace them, it just doesn't use them.

It supplants them with the same functionality.

That's literally the definition of replacement.

Indeed. Not complaining - I don't care for HN karma - but it is very odd that an easily searchable fact is being downvoted on a technical forum.

It provides inferior code and interfaces that are used instead of them.

So you're correct, in a way.

Not if you count in the god-awful shell scripts full of race conditions which it replaced.

Then it should be easy to audit!