We need easier/more integrated app sandboxing. Last time I tried firejail it was a pain in the ass, but looking at the docs it seems like it may have gotten better. Regardless, distributions could actively promote it (or something like it) as a default way of running apps, with some convenience features.