Thanks for making this post @asbear. It is healthy for a DPoS network to critically look at itself and its block producers. I think Steem is especially suited to DPoS security. I've had experience with other DPoS chains and without an active social nexus for their stakeholders to actively participate in, their decentralization and security tend to be compromised. If not immediately, then over time from disinterest and general entropy.

Are you concerning geographical redundancy?

One of my backup nodes is located on a different continent from my primary and secondary witness nodes.

Are you voting to any witnesses with biased feed or not feeding the price frequently?

Price feeds don't need to be too frequent. The actual network feed price ends up being the median of witness feeds over the last 3.5 days. It's supposed to be a bit fuzzy. It would not change much if every witness only updated twice per day. Backup witnesses especially don't need to update it frequently. Also the feed price doesn't necessarily need to be updated if the market price has stayed static for some time.

Some witnesses are still using 0.19.2 that is known to have a security hole. Then voting to the witness who are using 0.19.2 can never be a reasonable choice.

This is true and not true. The original release of Steem v0.19.2 has some security/DoS issues. There were two updates that patched these. Neither of them updated the Steem version number that gets reported by witness nodes. Later, a release containing both security releases was officially tagged as v0.19.3, but that was the only change between the latest security release and the tagged. So while some higher ranked and top 20 witnesses are reporting 0.19.2, they are likely running the patched version but did not see the need to update just for the version report change.

However I think it is important to broadcast that the node is up to date and that is why I updated my witness server to show it.