Kubuntu already uses MAC, and since this is using Muon they can plug whatever app store they want in, including kde-apps. If they wanted to, they could mandate

Kubuntu already uses MAC, and since this is using Muon they can plug whatever app store they want in, including kde-apps. If they wanted to, they could mandate the inclusion of AppArmor permissions files with apps, and then present the requested permissions to users at install, or even more easily do what Android M does and prompt the first time an access permission is invoked. That, and xdg-app is a thing. They will probably just use those. But there are a lot of ways to do sandboxing of apps on modern Linux.