I don't care about my server. It has everything to do with what it is preventing my browser client from doing. The whole point is using content from the whole web not my server.
Its not? Remember the 90s? There was a beautiful time before CORS and DRM in the browser. Browsers used to be something that actually cared about allowing full client control.
CORS sucks since Cross-Origin-Embedder-Policy: credentialless was never made standard across all browsers. It's a browser client restriction you can't turn off. If you want to do anything interesting with WWW content you have to run your own browser or run an out-of-box one off a proxy server that breaks everything.
Software wise their SteamVR / OpenVR stuff is very closed source. Someone had to reverse engineer their Lighthouse tracking which is hard but doing that is easier than making 6dof SLAM tracking just from camera access. All I am saying is its not easy and people will have to do hard work.
The hard part is making one work on it since none already exist like the hundreds that exist for normal computers like Deck. They might not let their 6dof headset tracking code be shared and getting that working would be very hard.
It's nice on something like Steam Frame where it's hard to install a new OS. Forcing a log-in like Windows is evil and sucks when you don't have internet.
I like that as a feature because I can use it like a normal root system. I have a pretty easy time seeing what goes in my home folder. It isn't esoteric to explore like system folders. If I had something I needed to keep private from Distrobox I could put it in my SD Card since it isn't mounted in the home folder on SteamOS and is in /run/media. You could also install QEMU in Distrobox or the virt-manager flatpak for a full sandbox.
I installed Antigravity with Codex in Distrobox Ubuntu. The Agents happily use sudo without care that it is a container. It's great when I run random scripts from the web that I don't even know how to uninstall and never worry about gunking up the main system.