Have you played with https://pods.io/ ? It does most of what ACF does and also lets you create custom post types through the UI. Curious about your thoughts on that vs ACF Pro and Custom Post Type UI.

...add a database, php runtime and the constant threat of security breaches and you'll be a bit more accurate

PHP runtime? PHP is incredibly fast. I don't install sketchy plugins on my WordPress sites so security breaches are a non issue.

I'd be more worried about one of those 10,000 dependencies in your React project doing something malicious :)