The job of synchronizing the system clock is not a job that belongs to the init system. It is a job that belongs to people who can write and debug the very complex cases of NTP.

The init system simply has to fire it up, take it down, and report on whether it's still running. Any further elaborations are features of the init system.

All the problems mentioned here were failures of the init system in doing things that the init system should be doing, but were hard to diagnose because this particular init system does not and never has put "easy to debug" as a high priority item.

"as much as possible" would be to put it in a virtual machine, or actually separate physical hardware, maybe in a multi-million-dollar bank vault to prevent physical tampering.

Then there's a reasonable amount of isolation, which would be to run it under its own user, which can only write to one or two directories, and can't read user directories or non-world-readable system config files. This is already common practice. (Creating this user at package install time, or in the initial base distro config, is completely sufficient. And simpler.)

"as much as possible" is really not worth it (and sucks resources away from implementing reasonable security practices elsewhere).