Nix is not simple, and it always seems to fuck up. AppImages have zero security advantages, they’re awful. It doesn’t even have sandboxing.
We-ell, in basic Unix-like terms you can just do a chroot while unpacking, check that no nasty places are being touched, and then rsync to root. I think some PMs already do just that.
Lmao. Not only would that not even be effective, but that’s also a ludicrous suggestion for the average user to do for every app they install. What an absurd suggestion.