Late reply, adding onto port vetting. They do try to incorporate their security mitigations into ports. E.g. they have `pledge`d chromium in ports.[0]
[0] https://undeadly.org/cgi?action=article&sid=20160107075227
[0] https://undeadly.org/cgi?action=article&sid=20160107075227
You can get a lot done without relying on ports. (Also, the ports are somewhat vetted, as far as I can tell.)