Be very careful with that assumption. The distros try, but one complex problem with a project that holds strong opinions and you may not have a fix. The gnome

Be very careful with that assumption. The distros try, but one complex problem with a project that holds strong opinions and you may not have a fix. The gnome keyring secrets being available to any process running under your UID, unless that process ops into a proxy as an example. Looking at how every browser and busybox is exempted from apparmor is another. It is not uncommon to punt the responsibility to users.