I'd go a step further, and say per-application virtualization. Every single program running its own (ideally encrypted memory) namespace, with its own assigned memory, etc.
Encrypted memory isn't part of arm yet, I was holding out hope with armv9 "realms" but not so.