There's `brew uninstall --zap $application`[1], and there's pretty decent coverage, but it's by no means comprehensive. If you feel inclined to contribute, the process is quite streamlined, and there's a helper script[2].
I used Appcleaner[3] for many years, and it's still perfectly serviceable
I'm keeping my eye on Pearcleaner[4], which is additionally open-source and written in Swift.
I followed a similar path as you did about a year ago. Having tried a bunch of options, I can recommend strongly Strongbox - fantastic native apps for iOS and macOS, with your choice of sync mechanism (local-only is also a first class citizen), and it uses the KeePass file format so you can use your client of choice on other operating systems/no worries about lock-in. Good system integration and autofill extensions. I also appreciated that there was an option for a one-time purchase.
We do have a `deprecated` caveat, but we rely on users to bring up that fact, as there's no way the maintainers can keep track of the status of every Cask.
There's also a fairly large push and discussion about removing duplication between Homebrew core and Homebrew Cask, so you should see things improve. There should also be Formula -> renamed Cask migration at some point, the issue has been raised in brew-evolution. (We have basic Cask <-> Formula support already).
Re: terraform specifically, looks like it's now in core, and `brew cask terraform` will know to do `brew install terraform` automatically.
Just wanted to highlight that as of this release, all the core code for Homebrew-Cask (the sister project for GUI apps) has been (re)integrated into the Brew codebase. This should allow for tighter integration between the two and a renewed focus on making installing GUI apps as painless as possible!
From a user/developer perspective, we've created a command line utility (`cask-repair`) to make version bumps as painless as possible. Would love to see more people using it [0], and we welcome suggestions and PRs (we have a few long-standing issues that have gone unaddressed, and fresh eyes are always good!)
You are absolutely correct. Homebrew-Cask favors convenience and availability of as many applications as possible, though we make reasonable efforts to avoid malicious actors by verifying checksums, download links, and (soon) GPG verification where possible.
You may be interested in https://www.macports.org for a build-from-source solution for OSS projects.
If you installed/updated via Homebrew-Cask [1], you should not be affected. 2.90 was not always compromised, and looking at Caskroom history, the checksum was only updated for the 2.84 -> 2.90 bump once [2].
I used Appcleaner[3] for many years, and it's still perfectly serviceable
I'm keeping my eye on Pearcleaner[4], which is additionally open-source and written in Swift.
[1] https://docs.brew.sh/Cask-Cookbook#stanza-zap
[2] https://github.com/nrlquaker/homebrew-createzap
[3] https://freemacsoft.net/appcleaner/
[4] https://itsalin.com/appInfo/?id=pearcleaner