Does NetworkManager completely obviate the need for the DHCP binary to call shell scripts?
Those scripts often exist because if the sysadmin needs something special to happen on DHCP, this is where he sets it. It's not "DHCP scripts get run by/are shell scripts," it's "DHCP binaries are prepared to call out to external scripts."
I've had to write these shell scripts (using ksh, since OpenBSD, so those are safe).
> A variety of other system services are used by NetworkManager
> to provide network functionality wpasupplicant for wireless
> connections and 8021x wired connections pppd for PPP and
> mobile broadband connections DHCP clients for dynamic IP
> addressing
It calls shell scripts, because, like I said in the comment you replied to, sometimes sysadmins need very specific things to happen when the machine gets a DHCP lease.
Just because bash is vulnerable in this case doesn't mean that networkd/network-manager will never be vulnerable.