An immutable linux base, like Flatcar, combined with dockerized apps for isolation and easy per-container updates could come pretty close if some engineering were put into UX.

You'd need to have unattended upgrades, or perhaps a companion app where you can send the user a push notification to say "hey bruh update your shit". Would also need engineers to support those updates.

Tailscale pretty much solved NAT traversal.