What is the Best Practice for System Administrator full access configuration?

How will System Administrator full access be handled with the profile to permission set transition? Will we now have to manually build that full access for every org? It can't be built in Permission Sets or PSGs because there will be users with the Manage Permission Sets permission who can tamper with it. Won't it have to remain in Profiles to preserve the security of the 5 "Permissions of Death"? 

Also, Packages usually have 3 options: System Admin, All Users, Specific Profiles. How will that new full access be added to only the System Administrators? #Best Practices #System Administrator Profile