Comment by the_rectifier

No an immutable OS does not help, also flatpak is necessary and selinux not powerful enough. You just need sandboxing.