I agree. I hear a lot made of Deno's "security" but process flags don't really make me feel much more secure when I've had to enable most of them anyway. At that point they just start getting in the way and giving me a false sense of security.
My understanding is that the current security flags model isn't really meant to be the final solution. They wanted to ensure that the browser security model isn't simply dropped like it is in Node, but to improve it further they'll probably need outside help.