If the user ensures the program runs in a separate Qube, but if they think it's a document presumably they won't do that. You can run every app in a totally iso

If the user ensures the program runs in a separate Qube, but if they think it's a document presumably they won't do that. You can run every app in a totally isolated sandbox but only by breaking every kind of OS integration and inter-app interaction, which will often be a bigger problem than security.