IMO it's a nice middle ground between a typical Linux system where every app you run has access to everything else you run, vs a system like Qubes where every app is locked down in its own VM