Bitcoin can most definitely be broken by soft forks. Rigorous testing of use cases is required. Do we really need some of these features? Bitcoin is working fine as is, and new changes to the base layer will inevitably carry risks.

As you point out, we are still discovering new possibilities with the current base layer now. Imo, we should indeed try to find vulnerabilities (and possibly fix them) before a gov does. But the fix should not be worse than the problem.

E.g. Ordinals might not be exploited now, but they might become an issue later (gov subsidizing spam-only blocks). It's good that we are aware of these attack vectors.