The problem is that this is a security solution that can't just be bolted on. Consider that Microsoft had this exact problem when it stopped giving everyone adm

The problem is that this is a security solution that can't just be bolted on. Consider that Microsoft had this exact problem when it stopped giving everyone administrator privileges by default, and the change was considered overdue rather than not-the-right-thing. You hear it over and over again that blacklisting will always fail, and whitelisting is what needs to be done. Well, when you finally do go from default-allow to default-deny, you're going to have to fix every single package to keep things working. Debian has accumulated a load of technical debt and has to pay all of it off before it can flip the switch on SELinux and see any benefit. It's understandable (if undesirable) that they feel that way. That doesn't invalidate the fact that they'll have to do the same for any whitelist.