IMHO that's kind of the point; to get a substantially different security posture, it's not sufficient to just rewrite the code but it's also necessary to change

IMHO that's kind of the point; to get a substantially different security posture, it's not sufficient to just rewrite the code but it's also necessary to change the design, and that would not be fully Unix anymore. It would not be enough to provide new, more secure options; and not enough to make them the default - to actually reduce the attack surface, you'd want to remove the nonsecure options, if required, at the cost of compatibility.