Yes especially for something fairly complex like an sql engine with views and full text search.

Through then it also seems that many of the newer bugs sl seem to be around more advanced features which sometimes can be disabled on compiler time. (newer=after they integrated fuzzing into their tested)

I wonder if it makes sense for Oses to ship two versions of sqlite one for the small local "trusted" database case and one for the sqlite as file format case which had many features disabled, only allowing the core subset of sqlite.

Through if you provide some "evergreen" software you can anyway just include your own version of sqlite. Potentially statically linked in.