As expected. Having been through the tools you mentioned plus ipmasqadm, I never bothered to learn iptables as I expected it to be replaced soon. Shorewall has been my tool of preference for firewalls.

If each self contained application declared what libaries it contains, the OS could have some sort of security auditing agent that identifies exploits on the system. Kinda like portaudit in FreeBSD.

The disk I/O latency can at least for HDDs be reduced if each application statically compiles in its libraries. I think Plan 9 actually does this, see http://harmful.cat-v.org/software/dynamic-linking/. There is a comparison of the file sizes of some command line tools there, but it would be interesting to know the binary size difference between statically and dynamically linked binaries for modern GUI apps that are using libraries like GTK or QT.