Given that GCHQ has spent at least half a decade pouring over the source code and hasn't found anything, I'm guessing it isn't spyware ridden - or when it is, then it is GCHQ compliant spyware - although they did not a bunch on "normal" security bugs.
Also, it isn't replacing 5G gear, it is removing it from the existing 2G, 3G and 4G as well as the network core.
And, "only half a billion", that is still an extra half a billion that they will have to source from end users. That means higher contract prices going forward, for example.