> Not yet, but it is no different than SELinux or seccomp not being the default on most Linux distributions, other than Android and ChromeOS. default for what?

> Not yet, but it is no different than SELinux or seccomp not being the default on most Linux distributions, other than Android and ChromeOS. default for what? a non-existent bundled anti-virus scanner? you don't need to sandbox something that doesn't exist selinux is enabled by default on RHEL, apparmor is on by default for ubuntu/debian (so "most" is covered) seccomp()/unshare() are necessarily application specific but still very heavily used (Chrome, flatpak, systemd, ...)