After that I run them in containers, no network access, ro filesystem.

And then build from source. And make sure it doesn't auto-update so no new malware gets in. This is my idea of a lot of extra work.

good luck auditing all transitive dependencies