"Appimages are great but there's no sandboxing or updates"

Actually there is sandboxing and updates, if you want to take an extra steps.

I prefer AppImages over Flatpack and Snaps for essentially the same reasons commented above.

I typically launch them with Firejail for the sandboxing. i.e. "firejail --appimage /path/to/appimage" instead of just the appimage alone. Seems to work just fine. Firejail has additional options that can be done.

Some AppImage creators do provide an update method that can be installed using zsync2, but I've not tried it since the whole point is disposability.