If an ORM can't be used to access a valid database, then that ORM sucks. (ORMs often suck for additional reasons, but that one's pretty hard to ignore if you have an existing database that you need to interact with.)

There are perfectly valid uses for composite keys. In a table that indicates a relationship between multiple other objects, for example.

Composite keys are fine as long as all the key columns are surrogate keys.

High bridges without guardrails are fine as long as you don't fall off.

Using composite keys can help prevent you from representing invalid states in the database or in your application. They can be guardrails.