[cpach]

If you can’t trust the applications running on your system, then I’d say it’s game over.

If you need to worry about that kind of thing then you need some kind of workload isolation. One way to solve that is Qubes OS.

Here are some other FOSS alternatives: https://fly.io/blog/sandboxing-and-workload-isolation/