I guess I might be convinced this is really useful to get the additional level of protection offered by the TCP wrappers, but we already:

1. have most, if not all, services listening on the loopback interface only
2. have a firewall that blocks incoming connections

So I'm not sure it's worth the effort needed to verify nothing is broken by a strict hosts.deny.

I guess we would apply a contributed patch that would come with a comprehensive testing report and updated design documentation, though :)