Find out if seccomp (and/or seccomp.py) would be useful to increase security.
A good good candidate for testing and confinement, because relatively simple to play with, would be url_to_unixtime (T102). Later also control-port-filter-python.
See also:
Related:
[Whonix-devel] hardening python scripts with seccomp.py:
https://www.whonix.org/pipermail/whonix-devel/2015-April/000347.html
seccomp.py would have needed a lot of effort to extend to be able to meet cpfp's syscall requirements while making sure its still secure. prctl's interface is far from pythonic to deal with. Not a solution that scales.
systemd.exec integrates and exposes Linux's security features in an easy to use manner. It was chosen instead.