I haven't looked too closely at this particular project, but if I were writing something similar, I'd explicitly make it hard to access any of the security-rela

I haven't looked too closely at this particular project, but if I were writing something similar, I'd explicitly make it hard to access any of the security-related settings, and make the defaults (for which upgrades are tested) secure by default. In this case, changes to security settings to deal with new threats would be distributed through the package update mechanism, not overridden by it. That is, the really interesting target user here is not the one who will drop into the command line to tweak /etc/ssh/sshd_config and then get annoyed when their changes are overwritten on the next update.