Composer 2 rewrote the solver. Typical installs are 50–80% faster and use a fraction of the memory of Composer 1. Lock files generated by Composer 2 are forward-compatible with 1.
The classmap autoloader is also faster: PSR-4 resolution uses a single hash lookup. composer dump-autoload --optimize remains the right move for production.
Composer 2.7 added the composer audit subcommand which checks installed packages against an advisory database.