Presumably because container breakouts are fairly common and "external Linux software downloaded by the user" is at least as presumptively malicious as an app f

Presumably because container breakouts are fairly common and "external Linux software downloaded by the user" is at least as presumptively malicious as an app from the store. Modern consumer systems need to be safe vs. the user being tricked to run terrible things. A docker or whatever isn't quite up to the standards[1] required on its own. [1] Though I'm very much not one of the pedants who refuse to see any security value at all in container isolation. Containers isolate software access (e.g. limiting access to libraries with vulnerabilities) and network communication (writing firewall rules for a container is a lot easier than it is for an app) really well, for example. Use them! But not for this.