TL;DR: systemd now can do per-service IP traffic accounting, as well as access control for IP address ranges.

TL;DR: you may now configure systemd to dynamically allocate a UNIX user ID for service processes when it starts them and release it when it stops them. It's pretty secure, mixes well with transient services, socket activated services and service templating.