Choice? I don’t use one but that’s due to never exposing ports that don’t need to be. Some that do that would still want one to provide “belt and suspenders”. Others want a specific one vs another primarily due to the software they use, that others do not. Given how trivial it is to install one does it really matter? I’m fine if they do as long as it is easy to remove, i.e., not a critical system/global dependency. I always install and remove some anyway, don’t you?

It’s wonderful but can be less complete or even missing typically due to settings (e.g., security), the environment (e.g., a container), or both.

Ditto VPN vulnerabilities. Belt and suspenders can help though if a remote is compromised likely all the things it uses will be, if not immediately then eventually.