After that I run them in containers, no network access, ro filesystem.
Not very practical for a solution that requires a browser plugin. The browser is where most of my interesting data is.
And then build from source. And make sure it doesn't auto-update so no new malware gets in. This is my idea of a lot of extra work.
Building from source is nowadays writing one sentence in a chat box. Your idea of extra work is either unbelievably lazy or perhaps outdated by a few years.