Browsers need usernamespaces to isolate Tabs from another. At least thats how Chromium does it, and I think Firefox does too.
Flatpak Chromium browsers are very experimental, Zypak is a thing and it sounds nice, spawning a seperate flatpak process instead. But its probably less secure than what is officially supported.
This is why there is no official Flatpak Chromium Browser, Vivaldi actively decided against because of that thing. The Chromium Flatpak does something better, but this was (at least some time ago) not done in other Flatpak Chromium Derivates.
Firefox is supposedly more compatible with the restrictions of Flatpak as it doesnt use user namespaces, but there also is no statement on how they do it, how it can be equally secure etc.
Browser can be best ran in Bubblejail, allowing user namespaces but the rest being blocked just as in Flatpak. The issue is simply that the bubblewrap in Flatpak uses a single seccomp filter, while just Browsers should be allowed to spawn user namespaces.
I am not sure about Distrobox, the Apps are spawned in a seperate user namespace but I suppose they can still use user namespaces anyways. But this is unnecessary overhead without any reason. One could isolate the Distrobox from the system, but portals dont cover that afaik.
So it stays a no. I think if the main image would not include Firefox, projects like Secureblue wouldnt need to actively remove Firefox so users could still layer it regularly. The problem is with having it included and downstream Distros removing it via an override.