There's far too much attack surface area in a modern web browser to not run the whole kit and kaboodle in a sandbox/container, or even use something like qubes or ad-hoc ephemeral VMs if you've got the resources.
The main missing link I saw was the need for what's essentially a KVM switch builtin to the laptop, so the keyboard+trackpoint+video could be physically cycled through the host and the little embedded machines.
That was an already supported way of using the usbarmory from the host btw.
I'd be ok with a software-controlled KVM from the host to do the switching however.
But the guest machines need to be physically routed into the display/keyboard/mouse and physically switched. It's just about physically sharing the input/output hardware in a compact and secure fashion.
The better attitude to take is the more things you do via the web, the more important it is to have good operational hygiene and separation of concerns with regards to your browser use.
Stop treating tabs as sufficient separation of concerns. Use browser instances. Put them in containers or even VMs if you can afford to.
There are a few different security models, based on different enemies.
In ye good old days, the enemy was every other user on a shared machine. Software and sysadmin were trustworthy, so the walls were built to protect users from each others. Most users weren't actively attacking each other, just accidentally stampeding over each other while getting their own work done.
Android and Windows today have a different model: There is only 1 user, the machine owner, with a reluctant sysadmin role. The software manufacturer (Google or Microsoft) wants to be the actual sysadmins, and their enemy is the machine owner mucking up the config. For the user, the enemies are the different applications, possibly from dubious sources and actively trying to steal as much data as possible. The walls are built to protect the manufacturer, the machine owner, the end user, and each individual application from each other, with the machine a battleground where everybody tries to backstab everybody.
Linux today sits in between these models. The owner is the only user, commonly technically competent. Applications from software repositories are not malicious, so walls needn't be as strong. Hacker 'freedom' mentality implies distrust to DRM, anti cheat, and other ways for corporations validating the owner. Meanwhile, applications deliver most values when allowed to access each others, sometimes in ways foreseen by nobody but the end user, and security walls like portals and digital signatures get in the way.
Except this rosy view of Linux isn't always true anymore. The web browser is clearly a dangerous, malevolent entity, with every website a potential attacker. vscode is another interesting case, needing low walls to do development tasks but high walls to protect the user from Microsoft's telemetry and political maneuvering. I'd love to containerize them, but keep the freedom to use other applications in all freedom.
On top of that, there is the linux self-inflicted problem of .so ABI instability. Gnome is one of the worst miscreants, famous for not promising anything, but a lot of other libs don't fare much better, so every containerized application needs to ship half an OS. The overhead in RAM and DISK is horrible, especially to a technical machine owner that understands what the machine really is capable of. Other rough edges are theming troubles, and portals delivering only 90% of what's needed, making it clear the containerized inhabitant is not on the same footing as the other applications.
These container problems are real, are not technical but coordinative, sociological and political in nature. Sweeping them under the rug with words like 'hivemind' helps no one and simply is not fair. I believe decent Linux containerization technology is possible if the community at large wants it. But the state of the art today simply isn't that great.
Containers are not perfect, and they have an overhead in terms of storage, compute, etc. That said, I see it's value and if done right is mostly invisible to the end user.
I've been using Pop os and flatpaks for the past several years, and really it's been almost flawless.
A few months ago I got a new laptop and couldn't use Pop as it was glitching. Moved to Ubuntu as it was supported and everything seemed to work fine. However, slowly snaps started breaking and more than once I've had to update snaps from the cli because the software centre just outright broke and refused to update the snaps.
Overall, snaps is really just janky on its own target os, and hating snaps doesn't mean we're anti-containerisation