There was a subtlety in the original question which we may have overlooked:
What impact, if any, does the Mill design (single address space, turfs) have on address randomization?
Its interesting to reflect on how a naive non-randomizing pointer-bumping mmap would provide a side-channel to an attacker because of the single address space.
If whether a service has allocated memory or not is inferable by others, then that may leak some internal state and the decisions that the service has made. This would be a bad thing.