Yeah, Apple wasn't keeping its version of rsync up to date at all (it was 2.6.9 for years?), so I have used Homebrew and its rsync 3.x for several years. I haven't had a problem. I don't think Homebrew is compromising my privacy. But of course, it's hard to know. Plus there's the risk of malware being embedded in whatever formula you install... In all, I decided it was worth it, anyway.
Now (with Sequioa, I think), Apple has suddenly changed to supplying openrsync, and it seems that some options have changed from what the old 2.6.9 version used (e.g., I'm pretty sure -E used to be for extended attributes, but now is executability).
Glad my scripts were written for the rsync 3.x with homebrew -- it has stayed consistant. (Note that homebrew rsync uses -X for extended attributes.)