I agree with you, but the immediate problem here seems to be that all major browsers support Brotli, and i think they all use the Google library, so they are all vulnerable.

Most of the discussion here is about vulnerabilities in servers, but it looks like its mostly a client problem.

Is there a way to turn brotli off?

Going back to your point, if we kept things simple we would be a lot more secure.