Lightning will need additional soft forks in order to be robust to less-trusted cpunterparties
Agreed (that's been even more clear than ever after this last week). I will say Bitcoin "was always meant to have" a covenant opcode though, and once did. It will eventually come.