I thought Ubuntu had AppArmor on and configured by default for many/most of the popular services (Apache etc). I often see 'updating AppArmor profile' log messages in system updates, in any case.
Only as long as you use the default paths and enforce the profiles... which should be the default for most people. But I think it's worth mentioning in case you have a specific application which you reverse-proxy, or install nginx, or ....
