It's definitely not perfect, but this also wouldn't affect GUI apps because there's no shell to send inputs into to run other commands. There's also more container escapes than just that.

But it's an added layer of security regardless, especially if you're not directly running software designed to escape the sandbox. A drive by exploit in a browser for example, is less likely to successfully escape because the stars needs to align that you have both a vulnerable browser and a vulnerable kernel at the same time.

The average credential stealer or NPM malware is likely to be contained and not even realize it's in a sandbox. You have to get malware and said malware is smart enough to exploit an unpatched CVE in your sandbox.

But no it's not perfect, the only way to safely run malware is on a separate physical machine with no access to your local network, and ideally with no wireless technology at all (to avoid WiFi/Bluetooth exploits). Even VMs can be escaped, there's a few CVEs for that too, and of course the processor bugs.

Security comes in layers, unless a layer is basically useless, it counts.

Isn't that irrelevant since tiocsti is disabled on modern kernels?

My understanding is that Flatpak was never designed to be a secure environment. It's all about convenience.

Running software you know you can't trust is idiotic no matter how well you sandbox it.