Distributors entering Flatpakland

The security benefits of Flatpak sandboxing are actually delivered by bubblewrap, there is no reason that system-installed apps can't be sandboxed with bubblewrap too. You just need to apply the same options to bubblewrap as Flatpak does, but disable the initial mount namespace that bubblewrap always applies by read-only-bind-mounting the system rootfs into the container and then maybe add some additional options to .desktop files about which parts of the home directory the app should be allowed to touch.