"it can prevent exploited server software from accessing data it does not own and executing arbitrary code"

Isn't AppArmor overly broad for something like that to be true? Exploited server software would happily provide access to the data of all users, since usually they all are withing the same trust boundaries anyway.

I think it's not a good idea to enable "security features" simply because it feels like they help, without even a threat model.