Assume your devices are compromised
The lack of per-application isolation with desktops is one of those ugly truths people try and sweep under the rug.<p>I foresee two potential solutions to this.<p>1) Run everything in a VM like Qubes (essentially nerfs certain application like 3D acceleration without major R&amp;D)<p>2) Utilize some container runtime to provide isolation for legacy applications and stub out features such as filesystem calls so they do not to be aware of its existence.<p>Microsoft tried to produce a crippled application runtime for Windows (UWP) with more security, but considering its lack of backwards compatibility and lesser feature-set it is not that surprising that adoption has been an uphill battle.