What you suggest is to write a sandbox yourself and solve all the issues (e.g. fix all software to work inside sandbox). For example, software might need an acc

What you suggest is to write a sandbox yourself and solve all the issues (e.g. fix all software to work inside sandbox). For example, software might need an access to a certain DBUS service, but you don't want to grant it an access for all other services. Out of the box DBUS doesn't provide means for that. Out of the box there is no way to prevent an app from getting information about a videocard (e.g. though Vulkan or OpenGL). And so on. Regarding AppArmor, how do you write a policy that would allow a text editor to open only files that user has chosen in Open dialog? In this case we can say that Windows is also absolutely secure - you can just write a kernel driver that would protect sensitive data from applications.