My impression was that with the switch from (UI)Webview to WKWebKit the webview is put in a sandbox automatically. At least the rendering is now out-of-process. Do you know anything about that?

Well, WKWebKit is in fact sandboxed, on macOS, as per what is going on with Webkit2GTK+, I am less familiar, but the project is well aware and on top of all security vulnerabilities: https://webkitgtk.org/security.html

Ok, didn't notice that this is a linux app that uses plain WebKit.

you could use the ex6:

http://www.hetzner.de/en/hosting/produkte_rootserver/ex6

a little more expensive (69 EUR) and less RAM (16 GB) but using ECC.