Hmm, I'd have blindly guessed that all of systemd's security options apply only per cgroup... and the sessions which run in their own cgroup wouldn't inherit them... but you may be right..