You're under the impression that they can compromise here, when this is false. That's a misreading of that comment. The "compromise" used by snap is to just not

You're under the impression that they can compromise here, when this is false. That's a misreading of that comment. The "compromise" used by snap is to just not have sandboxing at all. Mounting /bin fundamentally breaks the sandboxing, it's never going to work. The only other option is to change the entire OS to support this (and maybe the kernel too), and that's going to break everything even more. You'll have the same problem attempting to do this in docker. The main mistake you're making is thinking that Flatpak imposed this design constraint, when really it's a fundamental property of the underlying OS, that sandboxing solutions are forced to work around. It's possible to fix this with a distribution built in a very specific way like NixOS where you can theoretically mount different systems together, but that comes with it own sets of problems and things that it breaks.