How many people are paid to work on Nix/Nixpkgs?

FWIW there is (was?) an RFC for implementing SELinux and in my opinion this (or alternatively apparmor) could already add some „security“.

I suppose RFC 41 is what you mean. I would say “was”, unfortunately.

A recent Discourse discussion of sandboxing or constraining software for security was thread 7792, but it doesn’t seem to have gone much of anywhere.