[doubled112]

I like to think there are some groups thinking about these problems.

Could using something like Fedora Silverblue or OpenSUSE MicroOS (immutable OSes) plus Flatpak (containerized apps) plus SELinux (access controls) get you almost there?

These already exist, but I've seen the push back to the concepts in real life among admins around me, so I wouldn't expect the mass adoption it'd need to stabilize anytime soon. I'm not even including the Internet rage and arguments about these technologies.

[the_rectifier]

No an immutable OS does not help, also flatpak is necessary and selinux not powerful enough. You just need sandboxing.