You might want to expose more to trusted apps and less to more threatened ones. With kernel shim like gVisor you can have this with little effort.