Here's an alternative title for this post: these days, two lines in a systemd service file can easily constrain arbitrary applications to just the files and resources they need, and only those.
You can always use a simpler init system if you want
tl;dr: systemd isn't meant to be an init system, it's meant to manage services, and the alternative world where you don't have a unified system for managing services and events actually sucks.
embrace and extinguish unix philosophy.
> the alternative world where [] actually sucks.
You should bear in mind that there are plenty of people here on HN who have had the experience of running pre-systemd unixes and they know exactly how much "the alternative world" sucked. Spoiler: not much.
I don't really care to argue about it.
And worst: want to understand what the actual security properties of your policy are? The answer is buried very, very deep.