You can also create a blacklist of syscalls, which might be less "bad".
Anyway, the feature is worth it if only for the NoNewPrivileges options, quoting the manual:
"Takes a boolean argument. If true ensures that the service process and all its children can never gain new privileges. This option is more powerful than the respective secure bits flags (see above), as it also prohibits UID changes of any kind. This is the simplest, most effective way to ensure that a process and its children can never elevate privileges again."