there is currently no linux distribution where it's safe to run an application as is. they tend to have access to /home which is game over.
some people who actually care about security will create bubblewrap/bwrap profiles for applications and then run those profiles. an application isolated in this way will have a limited view of the system much less the ability to modify it. it usually takes the form of a custom /home for every app.
this still leaves the kernel exposed for an application to poke at and maybe escape with a 0day. some people run a VMM to further isolate the application, these days you can passthrough Wayland. if the application isn't graphical you should probably use gVisor instead.
some people who actually care about security will create bubblewrap/bwrap profiles for applications and then run those profiles. an application isolated in this way will have a limited view of the system much less the ability to modify it. it usually takes the form of a custom /home for every app.
this still leaves the kernel exposed for an application to poke at and maybe escape with a 0day. some people run a VMM to further isolate the application, these days you can passthrough Wayland. if the application isn't graphical you should probably use gVisor instead.