For security, GVisor is probably the most widely used userspace-kernel. A userspace kernel may also boot faster and use less resources as it can offload a lot of work to the host (FS drivers etc.)
Option Z) Everyone vibe codes their own custom OS. Each implements and exposes only what they want. Hacker has to beat up on it online to find vulnerabilities. He finds one and he only owns that one machine.
There's probably some middle ground between A and Z, but monocultures are fragile. All eggs in one basket, potato famines, banana fungus, etc...