You always had to. There’s no magic universe where an app has the full privilege to do everything you as a user can do while also preventing it from doing things that you could do. Whatever mechanism that enforces those restrictions is the sandbox.

No.

It's a step forward because you can, but it's ultimately up to you. You're still better off with Wayland, but no matter what you use, there's a huge glaring security hole if things are not sandboxed.

You don't have to, package maintainers and developers do. Flatpak gives them the tools to do this. Flatpak solves a lot of other problems like making program installs a user level task without touching the OS. Which is needed because in the future the OS will be an immutable image.