but realistically they aren't, so why are you even mentioning it?

not every app is on the windows or Mac App store, not every app is on the Linux package managers. even so there is no sandboxing so you're just waiting until one of them gets compromised and hope nothing bad happens

sandboxing hostile apps is the only true way to protect yourself, and even that isn't perfect