I have really come around to this way of thinking. Either you use the walled garden that is the distro’s own repos with only the blessed software of specific slightly out of date versions, or you allow arbitrary software but have to isolate it. The former works for some use cases but not for “Linux on the desktop” as most typical users define it.