Actually we don't need to move sandboxing into the library since in the *.service we can use minijail as well (do whatever we need by changing Exec):

[D-BUS Service]
Name=org.chromium.MyService
Exec=/sbin/start myservice
User=root