I agree with you, but the immediate problem here seems to be that all major browsers support Brotli, and i think they all use the Google library, so they are all vulnerable.

Most of the discussion here is about vulnerabilities in servers, but it looks like its mostly a client problem.

Is there a way to turn brotli off?

Going back to your point, if we kept things simple we would be a lot more secure.

"OpenAI found this in February reported it as unauthenticated remote code execution that works in both directions, so a malicious client can take over an unpatched server and a malicious server can take over an unpatched client that accepts compressed responses."

Every user is different

For me I'm a text-only user not interested in graphics

I do not use a so-called "modern" browser to make HTTP requests

I don't request brotli-compressed content/resources^1

Normally I don't send an Accept-Encoding header

Almost always servers to which I connect^2 will return uncompressed text, which is what I want. No Accept-Encoding header needed

Occasionally servers will send gzip-compressed text by default and will ignore "Accept-Encoding: identity"

However the popular so-called "modern" browsers will send an Accept-Encoding header whose value includes brotli (br) by default

Unsuspecting www users are consequently opted in to Google's brotli experiment. Me, I opt out

1. I use a text-only browser (1.3MB static binary) to read HTML. I compile it without brotli support

2. Other users may connect to different servers. Preferences vary from user to user