Have you read Spenders (the grsec maintainer) recent comments on Linux security development practices? They provided interesting insight imho, even if they were bit flame-y.

https://lwn.net/Articles/538221/ (ctrl-f spender)