Relatedly, does anyone know if the security guarantees around distrobox have gotten any stronger? Last I looked, they promised nothing, but curious if there has been any movement there.

I would love if there was a seamless way to launch a distrobox os with a separate user home that could not touch my host system.

Likely a Real Hard Problem, but even some isolation would probably be an improvement of running everything under the same user account.