> developers just start sandboxing their software by default

For many kinds of software, I'd rather see the distribution or package maintainer work on the sand-boxing itself. I'm thinking stuff like Zoom or Skype where you actually wouldn't trust the app developer.