Uhh isn't this precisely what the whole snap/flatpak movement is trying to fix?

I can talk about snaps, but at least they are offering a specific permission model which is usable for users to understand. i.e. Via the interfaces, I can know software x accesses my password-manager, home directory, camera etc... I can disconnect access to the given permission and have it enforced via the kernel and apparmor.

The applications themselves bundle only libraries that themselves are sandboxed/snapped.