What about zero-install?

You wrote: "Sure, if it is a one-user machine, [Zero Install] works fine", so let's look at
multi-user machines, which is (presumably) what you have a problem with.

On a multi-user system, a messed up system is worse than a messed up user account because:

1) All users are affected.

2) Any security policies that might limit the damage (iptables, AppArmor, SE-Linux) are
compromised too.

On a single-user system (where the user is the admin) and where the user doesn't make use of
multiple accounts or other sandboxing or security technologies you're right: Zero Install
isn't a significant improvement on Debs. Except, of course, for the benefits mentioned by the
OP:

"No admin rights needed, minimal dependencies on the host, multiple (eventually conflicting)
dependencies handling, distributed depository setup (i.e. an ISV can publish software by
himself)."

(and let's all agree that on a single-user machine, a user who accepts Zero Install's "Do you
trust this GPG key" question is just as likely to enter the sudo password when dpkg prompts
for it).