It's not a blatant lie. There is probably no default install in which I would not feel it absolutely necessary to change every credential stored on a system if it ever ran a compromised binary and a new install from scratch.

At best you are hoping that the malicious binary someone tricked you into running didn't also take advantage of an additional vulnerability to compromise everything. Keeping in mind that your adversary has every opportunity to test against the same environment you are running.

The only linux environment that I've aware of that takes isolation really seriously is qubes and even that isolation could be violated in theory.

I want desktop applications to have features that right now require substantial permissions to effect. The primary defense is and will likely remain not to install malicious software in the first place by installing from curated sources.