I think one of the reason why people disable AppArmor/SELinux is due to bad experience spending hours trying to figure out why their service fails to run after

I think one of the reason why people disable AppArmor/SELinux is due to bad experience spending hours trying to figure out why their service fails to run after a config update only to realize it was blocked by AppArmor/SELinux. They'll just disable it and says "good riddance". If you're running a headless server and can't figure out why your service suddenly can't start after a seemingly simple configuration updates (changing port, changing data directory path, etc), be sure to check AppArmor (Ubuntu) or SELinux (Red Hat distros) logs first.