Get an inmutable distro. For everything else, Flatpak. For gaming, AppImages are not sandboxed but you can always create a user account for gaming and logout/login again to avoid nasty surprises.

For instance, I use RecompLauncher as an AppImage, but I launch the recompilations themselves from a desktop shortcut after closing the launcher to get every CPU cycle for the game.