It was installed by default on the previous distributions (jessie, wheezy, etc), but it is not so on stretch. Before installing it, I wish to know whether there is some other preferred means to ensure time is synchronized. I just recently discovered the timesyncd daemon, however, it does not appear to be setup. Is timesyncd what should now be used? If neither ntpd or timesyncd is running, how does the RPi keep time synchronized?
The pi does not have a hardware clock, afaik, so
timesync are mandatory. Given
systemd's track record, I would stick with
Systemd track record: http://www.cvedetails.com/cve/CVE-2017-15908/
You may claim, yeah, all software is vulnerable and I say fine.
However, systemd team wrote their own code instead of using road-worn glic code. Amusingly, glibc had this exact same issue some years prior ...
Why develop time-sync if you have ntpd ? I don't know of a logical explanation. I would create a systemd unit that starts ntpd to keep time and disable timesync. That is just me, I have my reasons as outlined above.