I was under the impression Flatpaks are sandboxed. (I am not an expert.)

Flatpak is a utility for software deployment and package management for Linux. It provides a sandbox environment in which users can run application software in (partial) isolation from the rest of the system.

• https://en.wikipedia.org/wiki/Flatpak

I also keep Ungoogled Chromium around as a last resort (AppImage in my case).