Author here, happy to discuss.

I also constructed (with agentic help) this absolute mess of a timeline (linked in the article, but I think interesting on its own):

https://www.bugsink.com/blog/http2shell-timeline/

Source https://github.com/google/brotli for who wants to do a real security audit.

Security is always context dependent. For many use case it works. But if any one knows a better alternative that is battle tested and used please shout out!