It seems you skipped the bit where I said that those restrictions are often shipped by upstream and as such applied to everyone by default? It's one thing to lo

It seems you skipped the bit where I said that those restrictions are often shipped by upstream and as such applied to everyone by default? It's one thing to lock down your machine(s), systemd allows to lock down loads of services for everyone. It's not perfect, it doesn't do everything. But is your suggestion really not to make use of systemd abilities because maybe something else could be used? How does this not go against the defence in depth theory? Try and use (filesystem) capabilities. Now apply that security fix: capability is gone. Further, that was just a change made to your machine(s). It seems much easier to improve the security on all fronts instead of going for some idealistic super safe solution that either takes ages or doesn't happen. Example: pretty nice to restrict that Jabber daemon written in Java from accessing too much of the filesystem.