Yeah, a hardened kernel is great and I'm glad to see distros building kernels just for security-sensitive server applications.

However, setting kernel.modprobe to /bin/false is extremely high-impact in reduction of attack surface compared to how much effort it is (one line in /etc/sysctl.d/); you can keep running a full-featured distribution kernel, even one from Fedora or Ubuntu that's simultaneously intended for desktop use.