Some moar things I forgot to add:
* If this format gets adoption, insecure implementations in other languages will emerge. Just because it is easier and more correct to use the systemwide- or standard-lib-shipped SQLite lib rather than a custom-built one. For example a Python impl will just use the one available via import sqlite3, and it is the systemwide libsqlite3.so optimized fir speed and versatility.
* SQLite database can contain garbage, that can contain sensitive information. It can be cleaned though, but vacuuming takes a twice as large space as the file is, because for fail-recovery purposes it makes a copy first, and then clears the original file.
* SQLite databases can produce additional files alongside with database files. Journals and wrute-ahead logs. Deleting such files before they are merged into a main database file corrupts that database.