And what happens if my root filesystem is mounted read-only? So, please let's not allow tmpfiles to touch /etc...
That's an interesting question, I don't know the answer. I think it will fail because ignoring the error would be worse for most of the cases.
And all that assumes that you can execute systemd-sysusers, no?
systemd is the only init officially supported and partial updates are not supported so I think we can assume it will be available with this new version of the package. After thinking, maybe removing the dirs from the package is not a so good idea. It reminds me the /usr/bin merge, which doesn't seem to be possible with tmpfiles.d. However, systemd-sysusers seems to be a good idea, especially for package creation. And stateless boot is cool.