Appreciate the detailed and thoughtful response. That said, it seems like the more basic use cases can be accomplished more simply. For example, using capabi

Appreciate the detailed and thoughtful response. That said, it seems like the more basic use cases can be accomplished more simply. For example, using capabilities and proper groups instead of running things as root has been the recommendation for a while now. In that scenario, cupsd would never be able to do much to the system if compromised in the first place. A proper iptables/nftables default deny all incoming is pretty simple to setup, perhaps less so to maintain as services are added. I find the separation of concerns and maintenance a lot easier to reason about, ymmv.