an entire way? he didn’t do any of

control what was bootable on the device at a firmware level, enforce signatures to ensure that you couldn’t boot something unrestricted, remove the ability to be root, and block LD_PRELOAD so signals couldn’t be faked

The change was to systemd-userdb (and systemd-homed but that one most distros don’t use) which is optional. You can use the init system without it. IIRC You only need it if some apps want to use user records beyond the default NSS ones.

See also https://unix.stackexchange.com/questions/805105/can-systemd-be-used-only-as-an-init-system-without-its-other-components