Every unsandboxed app has Full Disk Access if Terminal does

Linux has similar vulnerability some extent, and dependent on the distro. Just because you're Linux doesn't mean invincible.

Qubes feels like the best answer, but ran too slow on my box to watch video.

Firejail feels like a decent balance but I found myself digging through config files when, e.g., I wanted to save a file from Gimp into a new location.

Expect any paradigm shift to take at least a decade.