I have tested the following settings and they significantly reduce the
potential for damage to the system and allows all the normal operations in my
tests.

Please change the default configuration to include at least some of these.

[Service]
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_AUDIT_WRITE CAP_CHOWN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_FSETID CAP_IPC_LOCK CAP_KILL CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_RAWIO CAP_SYS_RESOURCE CAP_SYS_TTY_CONFIG
ProtectSystem=true
PrivateTmp=true
MemoryDenyWriteExecute=true
RestrictSUIDSGID=false
NoNewPrivileges=false
ProtectHostname=true
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectKernelModules=false
PrivateDevices=false
RestrictNamespaces=true
ProtectClock=true
RestrictAddressFamilies=AF_PACKET AF_INET AF_INET6 AF_UNIX AF_NETLINK

LockPersonality=true
ProtectKernelModules=true
RestrictRealtime=true
ProtectSystem=true