For me, the point is not security, but maintenance. Whenever system upgrades have gone wrong, it's almost always been a partial update, and that just no longer happens.

I've found doing work in containers made things straightforward enough, as a developer. Though I still somewhat think that that's just moving the problem - I'm not quite keeping those containers up-to-date. `distrobox assemble` helps a bit though.