As an example of a special use case: I guess "ProtectHome=true" conflicts with what cups-pdf could do if configured (not by default), cf. "PDF output location" in https://en.opensuse.org/SDB:Printing_to_PDF when cupsd also child processes inherit cupsd restrictions (here the cups-pdf backend).