The line of defenses are different. All my Linux applications are either installed via Flatpak (which runs in a sandbox) or via the official package registry (which requires programs to be open source, and has a strong track record)