It is not a hassle because it is rare to run untrusted software on FOSS systems. Also spinning up a Xephyr window is trivial and not at all like "running it on

It is not a hassle because it is rare to run untrusted software on FOSS systems. Also spinning up a Xephyr window is trivial and not at all like "running it on a separate computer". Setting permissions for each and every installed application in a whitelist model you are proposing would be much more of a hassle. It is already a nightmare on Android where you wave away all kinds of access rights at the point of installing and you just don't care anymore because it becomes really annoying. The solution to better security is not sandboxing. It is running only trusted application in the first place and making the implementation of those applications simple enough so that many people can understand the source code.