@Steve I think there are still a lot of links with "community" subdomain in old discussions, replies and on plugin pages. I don't know if it's possible to update them all without spending much time on it. There's even still an open issue about this (https://github.com/Elgg/Elgg/issues/9818).
If I'm not mistaken the cause of the problem with the "community"subdomain is simply that it's not considered in the Let's encrypt certificate config (the "learn" subdomain seem to be and there's no issue with learn.elgg.org). I think I already suggested to fix the problem by considering the "community" subdomain in the certicate handling/config (maybe to Juho back then). But it seems to have been forgotten all the time...
Accounts are for participants / Friends phased out
Main use (or maybe even only use as you can send PM to non-friends by now, too) I see of friending is the (email) notification on new plugin releases, i.e. less "friending" and more "following". I would miss these notifications if friending would no longer be enabled.
Agree with removal of spam accounts. "No activity at all after X days after registering" could be one deciding factor to remove possible spam accounts (NOT counting spamming as activity!).
But someone could have asked for help via PM or is just interested in email notifications on new plugin releases - no visible public activity in this case. So, I'm not sure if removal of seemingly inactive "spam" accounts won't result in deleting also perfectly valid accounts.
Maybe phasing out twitter account sign-in / stopping registering with Twitter credentials would also help to reduce spam / spam account creation.
Personal pages phased out.
Not sure how many contain spam. Or the other way round: how many contain useful info. Read only and possibly clean up spam pages might be enough instead of deleting them all.
Does that include language specific support groups? I'm active in the German support group and we have activity there. It would be annoying for some to no longer be able to ask for support in their native language. If closing the language specific groups would then result in an increase in non-English postings in the main support groups it wouldn't be any better either. Though I think a limitation to group disussions only would be sufficient (group blog don't work anyway for anyone else but admins...).
Site notifications go away.
Okay with that.
Activity stream focused.
Fully okay with that.
Security issues should be reported to firstname.lastname@example.org!