[aforwardslash]

Rule of thumb, its not. Common stuff like address randomization is a recent default, afaik still doesnt have random process ids, and the base permissions arent stellar. However I would prefer jails any day of the week vs the clusterf** that are namespaces and cgroups.

[hedora]

How many remotely exploitable zero days has FreeBSD had in its init system this decade?

SystemD has to be in the dozens at this point.

[aforwardslash]

Right, because linux security == init system used by some distros. My experience with FreeBSD may be somewhat dated (I've used it since the 4.x days, provided commercial support for it for more than 15 years), an that is not my experience - at all. Obviously, it depends on the threat model you are considering and how far you want to go. The default install does not have (or had) sane security defaults, at least comparing to your random $ystemd linux distro; try installing both and give local shell to a red team and see how fast they get root access.

[adiabatichottub]

  sysctl kern.randompid=1

Oddly enough, not in the sysctl(3) manual