I am far from being an expert but I think that:

1. Is solved by most profiles which will only give access to files required by the given app so it would not get access to all content of the home folder. And even better (although not default behavior), is to use --private to isolate each app into its own fake home folder.

2. Is also not default but seems to be possible according to official wiki: https://firejail.wordpress.com/documentation-2/x11-guide/