[mbwgh]

According to the Arch Wiki though, firejail relies on blacklisting by default (although this seems to be subject to change).

So if it's necessary to be careful about the defaults and to audit everything carefully etc. (i.e. if it's not idiot proof), I am doubtful this is as helpful in practice as one might expect.

I still agree with the general point of your comment though.