At this level wouldnt a proper implementation be segregating the link into multiple VMs (or jails?) ? Or is that the same thing on BSD?

And how would you propose doing that? Note: what do you think the feature essentially does?