At a first glance, it looks like every single one of those vulnerabilities is mitigated by mostly standard practices for systemd service units, like not running

At a first glance, it looks like every single one of those vulnerabilities is mitigated by mostly standard practices for systemd service units, like not running as root in the first place, using NoNewPrivileges=, ProtectSystem=, PrivateTmp=, StateDirectory= and ConfigurationDirectory= etc