A) Make the Apple-provided system files read-only, maybe even put them on another read-only partition like iOS does.
They explicitly said[1] they were locking down system files 2 years ago at WWDC 2013: "in the future as we start to lock down the /System folder, you might actually get write errors.". As /System is already owned by root, write errors at /System means elevating to root won't be enough.
B) Assuming "rootless" is in fact a superset of what I mentioned in A, and going by the rumored name, they could be restricting what the 'root' user can do by default on OS X, matching some configurations of Linux where simply gaining root access doesn't automatically gain you total access. In other words, root can do things like load signed kexts, install system-wide software, etc, but not overwrite critical system files or perform various other sensitive actions that shouldn't be possible just by entering an admin password (which a LOT of software packages require during installation).
edit: also, they did include Hypervisor.Framework in 10.10 which is a significant engineering investment but doesn't seem to have a purpose at the moment (major virtualization vendors aren't likely to use it, neither are app developers. That leaves Apple...). I honestly wonder if they're planning to use it for security purposes in 10.11+. They did something similar with XPC, introducing it for use by developers first, and then in 10.10 they started using it extensively to isolate things in the OS (including Extensions).
After all, when they introduced App signing they could have made it so the mac would only run signed apps.
Of course they didn't do this.