Yes, layer as little apps as possible. Binary system-installing apps are a problem, but you should avoid these anyways. Also switching to hardened kernel and malloc are, but there is a project for that now in the “awesome user images” of ublue.it (not by them)