Have you looked at Firejail? It presents several options to contain applications, working on existing packages and AppImages. You could see it as a more easily configured verfsion of the security parts of Flatpaks without the application parts.
Could someone verify/disprove this? I would guess it drops privileges as soon as they are not needed but didn’t yet have the time to look at it and I have no sufficient knowledge to say whether privilege dropping is enough.
And to be honest it seems that to configure firejail to be as secure as possible takes a lot more effort than using Qubes OS. Both solutions seem to be squarely in the domain of people who who understand security, which excludes the people who needs it the most.