Trust in and maintenance of filesystems

That's actually a reasonable way to disable one filesystem though. The problem with CIS isn't their commands (usually), it's their whack-a-mole checklist bandwagon methodology. For example, it says to "disable secure redirects" by setting secure_redirects=0, but that actually disables redirect security checks, i.e. enables insecure redirects. They do also recommend setting accept_redirects=0 which actually does disable redirects, including secure redirects. So, their recommendation doesn't actually reduce security in this scenario, but it indicates that they don't have any idea what's actually going on, they just apply "security settings". Similarly, for filesystems, a correct approach (for servers at least) would be "disable automounting and only mount trusted disks", but that's hard to sell as a magic security script.