As mentioned elsewhere, it would be nice if once the machinery is available to kill all processes from a snap before doing a refresh, we also employ that on snap removal, so that after removing the snap, all processes are killed and then we unload the apparmor profiles that were loaded into the kernel (and also perhaps any seccomp bpf programs, udev rules, any device cgroups setup for snaps, etc.).