I think that might be the only way. That or maybe even this? https://github.com/89luca89/distrobox

I've always been interested in Qubes OS but it definitely seems like a very high pain point. I can see installing these things on VM's and then maybe trying to inspect traffic outbound to see if there is something untoward, but even that can be hidden pretty well.

Hell, I've installed some older "known good" packages and some of them have so many dependencies that are pulled in automatically, the app itself could be good but one of the obscure dependencies that it requires could be hacked and now you are still running hacked software. It just seems really scary to install nearly anything now. AI can inject an obfuscated backdoor in seemingly good software, and it can spread at a speed that humans couldn't have back in the day. I'm just hesitant with new software now and it's kind of sad. So much stuff I want to test but I'm afraid to test it.