As one example, I was surprised to find that the tor browser doesn't have an arm64 build :o
Thus far, it's my favourite laptop purchase ever. Beats the feeling I got with the IBM X series or the Ti Book. It's light, zippy enough, great Linux hardware support, and totally silent.
Still, it's not just graphics drivers: there's the oft-cited security patches, but also features for user-facing interfaces; Ie, an update to a URL parsing library might add additional codepage support transparently to an app that uses it.
Might be nice for hardcore fans, but good luck supporting anything there.
If the sandboxed app package model is what you desire then there's already a great and popular Linux distro for you: Android.
Nothing about "based on the AUR". Because it is liability. It is insecure, have to check PKGBUILD each install and update.
[1] https://wiki.archlinux.org/index.php/Arch_compared_to_other_...
For instance: the Pinebook Pro just got gles3 support via upstream mesa, but all the flatpaks with mesa haven't or won't update with any alacrity.
Users are left having to abandon sandboxing in order to get necessary updates.