Confused by unsafe flags being disallowed in dependencies

You really shouldn't have to weak-link an Apple framework explicitly; availability information on the symbols you use will take care of that. Tony's "it would be nice" already works. However, Combine (and possibly also SwiftUI?) missed some availability markers in its first release, and the standard workaround for that would be -weak_framework. And if you had a third-party library installed that you found with pkg-config, you might want to weak-link that too.