They aren't, unless you want to run untrusted apps outside of a distribution.

Flatpak sandboxing is a thing however, and probably good enough in the meantime.