Interesting post, David!
I noticed something in the OP of the Who’s Online plugin topic:
Think carefully before installing this plugin
I think “installing” might be better phrased as “enabling” there - if that’s technically correct.
The current phrasing could give the impression that having additional bundled plugins present is a philosophical or performance concern - when it’s really only about whether they are enabled. Since a newly core plugin that wasn’t enabled before is disabled by default after rebuild, the risk isn’t in having it installed with core, but in turning it on.