Comment 1 for bug 1728551

We have to have in mind that, *for example*, Thunderbird is shipping it's profile even on Debian Jessie, and if we update `tunables/global` *and* all `apparmor-profiles` to use `@{sys}`, and in the meantime if oldstable will not get `tunables/global` update, Thunderbird maintainers will have extra work to maintain two (with/without @{sys}) profiles.