The scan
I set up a service account on the MacBook and pointed a credentialed Nessus scan at it. Credentialed means it logs in and reads the actual installed software and patch levels, rather than guessing from the outside.
What it found
0
Critical
4
High
0
Medium
0
Low
22
Info
Four high-severity findings, all from an out-of-date browser. The fix was to update it.
The Nessus report