I thought that presentation was a little like looking at a hobby OS of a type, t...

I thought that presentation was a little like looking at a hobby OS of a type, then attempting to draw security conclusions for all of that type.

The NanoVMs unikernel for example, is pretty small, DoD supported, and has:

ASLR

    Stack Randomization
    Heap Randomization
    Library Randomization
    Executable Randomization

Page Protections

    Stack Execution off by Default
    Heap Execution off by Default
    Null Page is Not Mapped
    Stack Cookies/Canaries
    Rodata no execute
    Text no write

STIG