> The isolation technology that Flatpak uses (bubblewrap) isn't exclusive to Flatpacked

I wish flatpacked apps actually used the isolation (most don't, so http://flatkill.org/2020/ is still true today) but that isolation is mostly under the control of the packager, not you.

On this point, Deno ( https://docs.deno.com/runtime/manual/basics/permissions ) and pledge.com ( https://justine.lol/pledge ) are better; you have to explicitly allow-list what you want, instead of hoping that the potentially very untrustworthy and third-party packager had your best interests in mind and denylisting what you don't want.