With regard to resources: All later posts about esp2866 devices are no longer about the first esp-01 but about the newer versions with or without development boards. They have 4 Mb so I don’t think resources for the ino are a problem (but I might be wrong).
With regard to “more services = more security risks”. Everything is currently in http (versus https). How safe do you think it is anyway? I can tell you: not at all! One service more or less doesn’t matter. It is not a hardened server or webserver at all.
The ESPs are used within my home behind a firewall. If someone breaks my firewall I have a problem anyway and a couple of simple ESPs measuring data or controlling a relay do not really matter. Risk analays is part of my job. It always comes down to chance/possibility of being hacked, urgency when hacked and impact. For me these ESPs are negligable compared with my other network devices/appliances. (but maybe I suck at that part of my job )
With regard to the time server: You can simply use the buildin time functions by including <time.h>. It is only used on startup and only increases the compiled ino to bin minimally. I use it on another esp.
With regard to my approach: It is not that simple as I thought as mdns functionality comes from the ino and variariables are used from the javascripts which are not there on initial bootup.
And with regard to mdns at all: I think it is a matter of preference and I agree that having it as an option would be preferable.