The answers are good, with the exception of one point that I disagree with. In the article, the author states that IDE's obviously need to have full file system access in order to work. This is papering over the fact that development tools are some of the most critical pieces of software in an organisation, and if it becomes compromised the entire production chain may be compromised.

It doesn't help that a lot of development tools happily downloads random code from various repositories during build, so not only are the applications sensitive, they also are more vulnerable than anything else.

The solution here is of course to isolate the development environments and give them private structures that contains everything the tools need. I'm not sure if Flatpak has the ability to provde a "virtual home" or some such, it should be available.