At this point it looks like io_uring is really the new syscall interface of choice. Given that most (not all, but a significant proportion) syscalls are for I/O purposes, it makes sense to bake in the concept of async completion.
Is it still slower than epoll?
Has the security situation improved?
IMO the big problem is that it's very hard (and AFAIK no way has even be proposed) to restrict from the outside which syscall-alikes are allowed via io_uring. This is trivial with regular syscalls. That's important if you ever co-host applications with different security domains.
I mean, turning it off sort of ruins the point of the exciting new interface.