After that I run them in containers, no network access, ro filesystem.

Not very practical for a solution that requires a browser plugin. The browser is where most of my interesting data is.

And then build from source. And make sure it doesn't auto-update so no new malware gets in. This is my idea of a lot of extra work.

Building from source is nowadays writing one sentence in a chat box. Your idea of extra work is either unbelievably lazy or perhaps outdated by a few years.

Why even ask the question?

good luck auditing all transitive dependencies