Very interesting question indeed.
For example, is the main concern the all-in-one container approach,
Personally I don't understand the only 1 process per container philosophy. In my opinion, that is too extreme and gets complicated to manage. I prefer to think of containers as lightweight VMs. And why not? Linux has no equal in terms of process management.
PianoTell-web already runs multiple processes but Flarum-In-A-Box is superior in that regard since it uses s6-overlay to manage the processes. So I'm not sure this is a disqualifying reason.
the large number of bundled extensions
PianoTell launched on FreeFlarum which has even more extensions. It never was a problem because I could disable all the extensions I didn't need.
upgrade stability, security hardening, or operational concerns like backups and scaling?
These are the main reasons. All the secrets are in the clear, for one. Although, scaling is probably not an issue for smaller communities.
The big gotcha is that all the data is stored directly on the container. So when your container is gone, so is your data. I didn't think volumes or file/directory mounts were worth the added complication for Flarum-In-A-Box.
