Snaps are actually a great security and packaging advance that decouples package dependencies from a common library set, while maintaining a mechanism to patch and upgrade otherwise dangling library deps. It also starts down the long road to confining software, because what you run shouldn't automatically assume all your privs. Basically iOS style apps for Linux.

People who pipe web content to a privileged shell are on their own at present. Arguably they should be warned, but that assumes taint tracking at every level of the operating system, and no production OS has that. If the software is a dependency shit show then putting it in docker (and then into a VM) is a better compromise.

Windows is already deprecating the installer model for the app store and cloud concept, they just didn't make it stick the first time round.