I deliberately made the headline obscure for fun.  Anyway, the most recent bugfix release for dhcpcd, 9.1.2, happens to set capiscum/pledge-style privilege separation for the program – without requiring those technologies to be built into the system.