It reads a bit differently to me. There is no value in enforcing stricter policy in mutter if package in question is installed as root (which happens with apt/

It reads a bit differently to me. There is no value in enforcing stricter policy in mutter if package in question is installed as root (which happens with apt/rpm packages, but non-sandboxed flatpak/snaps too). There is work needed to make it work, but the first step should be to not have package have root access during installation, or else it could disable any protections on the mutter level. Observability sounds like a nice feature that you should push for independently.