I've had a quick look and taking the strict view that any driver that sends a command but does not wait for a reply is vulnerable then it is quite a lot. All the LX200 based drivers to start with. Some of the drivers don't use a sendCommand() subroutine, the serial writes and maybe reads are embedded in each command. The Moonlite DRO driver is like that.
I spent quite a lot too much of my professional career fighting ths sort of thing on electron microscopes - just the same except that the hardware was more expensive. I had almost no say in what was implemented and one manufacturer seemed to use a different intern to do the external control for each microscope model.
That would be awesome. If you don't mind send it to Andrew at macobservatory dot com. I'm on Catalina 10.15.5. Where is the driver where I would drop it?