I don't know what a "real security audit" is in this context but I think I shared enough pain (with links) from my personal perspective to give a head start I suppose.

I agree security is always context dependent but "passes untrusted input through a package built in C which takes over a year to make security releases when the changelog already references those" makes the set of contexts in which something passes the test very small

One better alternative is presumably the Rust crate (mentioned in the article) it just happens that there's no Python bindings available for that.

Something that has flown under the radar and is missing from your timeline: https://bugzilla.mozilla.org/show_bug.cgi?id=2029458

Thanks for the timeline!