Systemd has all sorts of options. If a service has certain sandbox settings applied such as private /tmp, private /proc, restricting access to certain folders or devices, restricting available system calls or whatever, then systemd creates a chroot in /proc/PID for that process with all your settings applied and the process runs inside that chroot.
I've found it a little easier than managing a full blown container or VM, at least for the things I host for myself.
If a piece of software provides its own service file that isn't as restricted as you'd like, you can use systemctl edit to add additional options of your choosing to a "drop-in" file that gets loaded and applied at runtime so you don't have to worry about a package update overwriting any changes you make.
And you can even get ideas for settings to apply to a service to increase security with:
systemd-analyze security SERVICENAME
It's antisemitic? I haven't finished it yet, or maybe I'm just dense, but how is it antisemitic? And isn't Sirona trans? And I've met at least one openly gay married couple in game too.
I don't want to be defensive of something bad or to demean your opinion, I just want to understand this point of view since you aren't the first person I've seen express it.