This is a problem that also exists in many Flatpaks: plenty of applications get carte-blanche access to the OS filesystem, and "breaking out" with symlinks or chained attacks has proven trivial over the years. There are so many of these exploits that they simply stopped patching them after a certain point. Isolation is much better provided by other tools like Firejail.