21. What’s the point of that security domains concept above?

The point is limiting your losses. If someone should happen to break into upsd in that environment, they should only gain access to that one user account. Direct access to the serial device is not possible, since that is owned by another user.

There is also the possibility of running the drivers and upsd in a chroot jail. See the chroot option in security.txt, upsd and driver documentation.

Why give would-be vandals any sort of help?

Put it this way — I wrote good chunks of this stuff, and I still run the programs this way locally. You should definitely consider using this technique.