but on desktop Linux you need to either create a new user (and remove world-readable permissions from your main account files), or create a custom Docker container, or create a chroot, or launch a VM

You don't need to do any of that stuff to achieve application sandboxing. bubblewrap or firejail exist for exactly this purpose. Firejail in particular can integrate with AppArmor (which most mainstream distros that aren't RHEL or Fedora ship with) so you get MAC on top of sandboxing.