What the application is doing is relevant to application security, but the whole point of securing the OS is to eliminate the necessity for "trusting" the application.
When you are securing an operating system, you must assume the application that is exposed to the operating environment (be that the internet, local LAN, even simply user logged into the workstation in the case of a GUI or CLI app) is compromised.
The primary goal of most security measures is preventing and detecting privilege escalation and lateral movement within the OS or network.
There are a lot of best practices that apply in general to securing an operating system. If you want to dig deeper, one of the best resources for this information is provided by CIS (Center for Internet Security).
CIS has hardening standards for most OS's yes even including Ubuntu. https://www.cisecurity.org/benchmark/ubuntu_linux
These are standards that many security conscious organizations apply to their servers. The US government takes it a step further with DISA's STIGs.
DISA STIG's are similar to CIS's benchmarks, but result in an even more locked down environment and place extreme restrictions on which crypto libraries are allowed to be used.
In short, securing the OS is a standard best practice that all organizations should be doing. Unfortunately most startups lack engineers with the expertise in building custom linux images so a lot of folks are quite unfamiliar with hardening procedures.
You should absolutely NOT use a non-standard OS because you think it will be more secure. It's a much better idea to use known industry standard security benchmarks on supported Linux distributions than trying to bake your own standard some non Debian/RHEL based bistro.