Well, whoever does that for closed-source software is going to basically have to do what they have done. Probably some kind of cross-distro fixed binary target, client software to do updates, probably some level of DRM functionality like steamlib integration.

If it's not Steam, it's gonna be something that has a lot of the same characteristics.

Personally, I kind of wish that there was better sandboxing for apps from Steam (think what the mobile crowd has) since I'd rather not trust each one with the ability to muck up my system, but given how many improvements Valve's driven so far, I don't feel like I can complain at them for that. A lot of the software they sell is actually designed for Windows, which isn't sandboxed, and given the fact that not all the infrastructure is in place (like, you'd need Wayland, I dunno how much I'd trust 3d drivers to be hardened, you maybe have to do firejail-style restrictions on filesystem and network access, and I have no idea how hardened WINE is), it'd still take real work.

Their use of per-app WINE prefixes helps keep apps that play nicely from messing each other up, but it isn't gonna keep a malicious mod on Steam Workshop or something from compromising your system.