So I can only give a recent example of pinsyscalls(2), which associate a system call to a specific memory address to prevent return-to-libc attacks. It's subtle

So I can only give a recent example of pinsyscalls(2), which associate a system call to a specific memory address to prevent return-to-libc attacks. It's subtle system/OS stuff that make it secure. You throw that out the window installing third party apps though... OpenBSD is best served pure if security is your main angle.