Comment by hollerith

>running untrusted code as another user gets you 80% of the security you need if you don't trust something, and running it in a mostly empty container gets you another 19%.

Like I said, the Android team does not think so. Nor does the ChromeOS team, which uses selinux to sandbox the browser, something no other non-Android Linux distro does (except possibly secureblue, which sadly almost no one uses).