I'm very happy with the packages I get from Debian.
https://www.debian.org/doc/debian-policy/
Add a bit of common sense, and it is enough for me (and I assume for most people, but hey!).
The solution is to simply not trust the software at all. This is the approach Qubes OS takes, and works really well. Most regular users don't really need to go as far as Qubes OS does though, and application level isolation that Flatpak is trying to achieve is enough.
I don't see how anyone can accept that any random piece of software is allowed to access all your personal files is acceptable. We certainly don't accept it on mobile platforms (how many posts do we see here about applications that scrape user's contacts?) so why should we accept it on the desktops?