Hacker News Reader

Biggest market for BSDs is the server one, so it's a simple lack of demand.

SELinux can be somewhat classified as an app firewall but it's a policy framework after all and that suited for that.

NetBSD actually does better in that regard with its VeriExec stuff.

Maybe the closest things are chroot jails and pledge/unveil, both of which are application-specific or built in to the package. (I'm agreeing with you.)