Is this a usable systemd startup script for bitcoind?
I haven't tested this particular systemd service file, but from my experience in Ubuntu, you need to create the directory structure beforehand and the user running bitcoind would need write permissions to /var/lib/bitcoind/. Otherwise the service will end with errors and will not run.

If you start bitcoind as user bitcoin, the daemon by default will look for and use /home/bitcoin/.bitcoin, which will inherently have write access. For simplicity, I suggest you point to the .conf created in this directory. I also suggest placing the pid file in this location. 

I am not aware of any security vulnerabilities of using the user's home directory for -datadir and -pid, as those locations need to be write accessible to user bitcoin wherever you put them anyway; I'd actually like to see a discussion on this topic. Using the settings suggested in that systemd service file would mean you'd have to give user bitcoin write access inside a directory that is normally modifiable by root only.

Consequently, I suggest a slightly modified systemd service file:

[Unit]
Description=Bitcoin's distributed currency daemon
After=network.target

[Service]
User=bitcoin
Group=bitcoin

Type=forking
ExecStart=/usr/bin/bitcoind -daemon -pid=/home/bitcoin/.bitcoin/bitcoind.pid \
-conf=/home/bitcoin/.bitcoin/bitcoin.conf -datadir=/home/bitcoin/.bitcoin -disablewallet
PIDFile=/home/bitcoin/.bitcoin/bitcoind.pid

Restart=always
PrivateTmp=true
TimeoutStopSec=60s
TimeoutStartSec=2s
StartLimitInterval=120s
StartLimitBurst=5

[Install]
WantedBy=multi-user.target


Note that if you place PIDFile= before ExecStart= you will get a warning in the log, but the service will run anyway.

There is this current template https://github.com/bitcoin/bitcoin/blob/master/contrib/init/bitcoind.service,
maybe you can take some security improvements from there as well. This template uses RuntimeDirectory=bitcoind to create /run/bitcoind owned by bitcoin (and places the pid file in there). It places bitcoin.conf probably in a read only environment, and ommits -datadir, which will in this case default to /home/bitcoin/.bitcoin.