Security of Bubblewrap-type sandbox vs. privilege separation between Unix users

Almost every user of a computer nowadays runs untrusted code (does not have to be known-malicious, e.g. some complex closed-source tool) and processes untrusted data in complicated formats; but doing that securely seems to be a complicated topic, especially with the hardware vulnerabilities that were greatly publicized in the last couple of years. I presume security researchers would use more reliable isolation methods (a virtual machine or a separate physical machine) than the ones I want to discuss here: Linux seccomp-bpf. (OpenBSD folk are welcome to give their insight, but I have almost no experience with OpenBSD so I am not talking about it.) Seccomp is obviously great for applications like Chromium, where a multi-process sandboxed architecture was part of its design presumably from the beginning. But what about the other, more common, usage of seccomp; running untrusted code or processing untrusted data with various sandboxing programs like Flatpak/Bubblewrap, Snap, Systemd-nspawn, Docker or Firejail? Is that secure? Does it make sense to have it in addition to or instead of established Unix methods of privilege separation between users? Why? To expand on the "established Unix methods", I am thinking about executing a process with an unused UID, GID, etc.; while stripping capabilities in the case of modern Linux. The administrator or "power-user" would accomplish this by writing C code or using utilities like setpriv or setuidgid. (Although a separate setuid-root utility may be needed to provide the functionality in a rate-limited way to less privileged users.) I am assuming in the question that in both cases the new technologies like Namespaces and Cgroups may also be used. Possibly related HN comments (basically, a possible issue arising when sandboxing complex utilities is requiring syscalls that make the sandbox useless): https://news.ycombinator.com/item?id=14409234 https://news.ycombinator.com/item?id=13550200