Microsoft reports several bootloader vulnerabilities

That grub has security vulnerabities does not surprise me, it's just too big. That's why Lennart recommends systemd-boot. (Incidently a Microsoft employee, but I have no information that he would have been involved in these discoveries.) U-boot again is typical embedded software, a field generally known more for hacks than strict programming practices. So I cannot say I would be shocked. That said, I would be surprised if systemd-boot or Microsoft's loader had zero vulnerabilities hiding somewhere.

When does Microsoft open their source for searching vulnerabilities?

Yeah, and because grub is too big. Says systemd, of all places.

Pulseaudio still doesn't work reliably.

I think Pipewire has completely replaced Pulseaudio where it matters.