The mechanisms that allow for program confinement also allow you to construct an immutable OS.

> Running each daemon in its own fs/user/net namespace comes a lot closer to mimicking the value of SELinux than making the OS immutable.

Maybe, but it's still pretty far off. SELinux is about removing DAC/an all powerful user much more than it is about sandboxing.