> nevermind root. The apps have unrestricted access to your filesystem under the same privileges as your user

Easy to get root anyway, just add an alias to sudo to .bashrc and whenever the user follows an online instruction guide into fixing something they'll get root privileges.

or overwrite LD_PRELOAD for the user

or replace the users desktop files and pretend to be another application (because you can overwrite /usr/share/applications launchers in .local/share/applications)