DefaultEnvironment= is “not really global”. It’s “pretty good but not perfect”.
DefaultEnvironment= sets environment variables it for all systemd units  , virtual consoles but not for graphical X sessions. I don’t know why yet. This may or may not be fault of systemd. The login manager or X might unset environment variables.
It can be viewed using:
I don’t know yet a (full) list of exceptions where
DefaultEnvironment= is effectively, eventually ignored due to whatever cause.
DefaultEnvironment= might be be good enough for
seccomp workaround. Implementing now.
 To add more potential exceptions… Individual systemd units using
EnvironmentFile= may or may not change this. Untested.
 Good enough for our use case as long as no APT related systemd units do this.