So what is the way forward for Linux to have sandboxi g as strong as Android? Appimage everything? I know it's possible now hacking together things, but I mean by default and integrated.

Maybe we could develop trustworthy free-software applications again, instead of trying to establish a commercial apps ecosystem on top of Linux?

Amutable. Building an immutable and image based system which even the installer can't modify, a-la macOS.

One systemd patch at a time.

Note that the sandbox also relies on the fact that most userspace is managed, the Android team is very clear on what they see as supported use cases for the NDK.

AppImage is not a sandbox