Assume your devices are compromised
The lack of per-application isolation with desktops is one of those ugly truths people try and sweep under the rug.I foresee two potential solutions to this.1) Run everything in a VM like Qubes (essentially nerfs certain application like 3D acceleration without major R&D)2) Utilize some container runtime to provide isolation for legacy applications and stub out features such as filesystem calls so they do not to be aware of its existence.Microsoft tried to produce a crippled application runtime for Windows (UWP) with more security, but considering its lack of backwards compatibility and lesser feature-set it is not that surprising that adoption has been an uphill battle.