This is already done in nixos for daemons: https://github.com/NixOS/nixpkgs/blob/65a62c9f75dc97714f836c... and that's on top of the usual stuff systemd exposes.

Then you get firejail for more custom apps. You still need that layer and needs to be configured per-app. Would moving config+state into one path really improve the experience? In what way would it be simpler?