> that can be mostly mitigated by using easy-to-use third-party sandboxing tools (Sandboxie, Firejail, a VM)

We also need solutions for typical end users. In the case of SecureDrop, the users will include people with near-zero technical capability, and little time or motivation to learn something new.