Note: The following is all my opinion, based solely on my use cases. I do not use a "Desktop Environment" I run startx and use a Window Manager.
dbus has it's uses.
But if one does not need it, one can rightly feel a bit peeved about it coming in as a dependency.
Look at where dbus is primarily used (Note: primarily, not all):
Desktop environments
How is it used?
A major use is "configuration": storage of preferences, getting "theme" information.
Another common use is allowing a non privileged user the ability to do privileged operations: shutdown/reboot the system, mount devices.
So is it useful? Sure.
Does everyone need to run it? No.
Performance: Like every other bit of software ever created, a lot of times performance is tied to how something is used. Saying a Yugo is a piece of crap because it can't run with an F1 car is ridiculous because you are not using the Yugo as it's intended. A Yugo makes a fine flowerpot
Since I don't run a DE that needs dbus, applications that are built with dbus enabled (firefox) spend time on starting that try to do dbus things, then they wait because dbus isn't running/doing anything, then they time out and continue on. Simply renaming /usr/local/bin/dbus-launch and dbus-daemon the applications start up quicker and feel a little snappier using because they aren't doing the dbus interactions. Whatever functionality they are doing, I don't miss.
The bigger question really revolves around Ports/Packages:
Should there be a way to build a set of "DBUS Disabled" packages? Like a "no dbus" flavor for every port that may use it?
In my mind the answer is "Yes, but...". Yes because a lot of people would like it, "but" because it's a lot of work and touches a whole lot of ports. Would the port maintainers like this? Probably, but they aren't going to do it without help.
Disabling dbus will change the functionality of some things, if a user decides they can live without it, don't judge them for disabling it.
At the same time, don't judge the folks that like it, like what it provides and want to use it.
dbus has had security issues in the past, maybe internal, maybe related to polkit. I don't know if there is any information one can get from dbus that could be pushed to daily/dailysecurity logs/emails, but if so that would help folks understand what it's doing.
Final thought:
use it, don't use, whatever fits your needs. Have technical discussions about it, not religious ones. If it bothers you enough one way or the other, see if you can help the port maintainers.
If you got this far, thanks and my apologies for getting a bit wordy. Time for more coffee.