How does the problem of running some untrustworthy code get better by adding even more binaries? Is the goal just to use the kernel's process isolation feature

How does the problem of running some untrustworthy code get better by adding even more binaries? Is the goal just to use the kernel's process isolation features that you can access with `unshare`? Or do you mean to just bypass the installation step (because that purportedly contains adware)?