Could you link to issue reports to back that up (or maybe file them if these are novel findings)?

If that’s too much of an ask, at least reference the code you found for things like “mxc sandbox escape” or “bubblewrap setuid is wrong”. Those claims require evidence.