I also take issue with some of your comments. How is VBscript any less secure than JScript, batch, or PowerShell?
Additionally, I don't think you realize that if you cutoff VBScript, thousands of installers and deployments that have worked for decades suddenly stop working. Only two scripting language are available from Windows Installer: VBscript and Jscript. Microsoft has not integrated Custom Actions with .NET (Framework or Core) - although WiX has some capability here. Microsoft has even actually stated to use PowerShell as an alternative. This is completely misguided. Firstly, PowerShell is usually disabled by default. But, let's just say that the system allows an installer use it. There is no way to pass the installer handled to PowerShell. It has to be in the same process as msiexec.exe instance (which may or may not be elevated depending on the scheduling). Without the installer session handle, any out-of-process becomes useless as a viable Custom Action.
I don't even think Microsoft truly realizes the mass damage this will potentially cause. It's not just for administrators, but real-world including IIS and potentially even most Installer packages. The cost to fix this globally could literally be in the billions of dollars.