While FreeBSD tends to be pretty good about security by default, the HardenedBSD downstream derivative is out with their latest release based upon FreeBSD 12…
Source: Phoronix – HardenedBSD 12 Released With Jailed Bhyve, Disables SMT By Default