Downside is it occupies a CS on the QSPI controller, presumably bonding to the same pads as the QSPI pins on the package, so now you only have one external memo

Downside is it occupies a CS on the QSPI controller, presumably bonding to the same pads as the QSPI pins on the package, so now you only have one external memory IC. It's a very small tradeoff all things considered, but is still technically a tiny disadvantage over highly integrated MCUs. A potential alternative would have been a directly memory-mapped NOR flash die, but that would have required more bond wires, more dedicated pads on the die, a port on the bus, and on top of that the memory die would have been more expensive too. An older (and often impractical) alternative is to use a single die with both flash and SoC on, in the same process. This usually forces a larger-than-desired process node to match the flash technology, making the SoC take up more space. The result requires no extra bond wires or pads, but now you're really manufacturing a flash chip with an MCU attached.