Linux

All of the methods have big issues but I would still prefer them over messing with a mutable system

• snap is likely the most secure by avoiding user namespaces, using AppArmor only and thus being very flexible (also for use for kernels, drivers, browsers ...) but it is proprietary, nobody likes it and Canonical doesnt wanna stop somehow.
• flatpak has the biggest amount of officially maintained packages, but packaging is often really bad, runtime extensions arent really a thing, instead people just put ffmpeg binaries in their packaged and think that is fine. Flatpak does consume quite some disk space and more importantly RAM for the duplicated things
• nix doesnt have any of these, but sandboxing is hard, there is either stable or unstable, changing and configuring things is very complex. Likely no official packages. Still the method I prefer.
• homebrew idk? Never tried, mac focused and with more and more linux features like sandboxing. No idea
• distrobox/toolbox is pretty hacky, relies on entire distros running in parallel with no shared anything (currently, afaik bootc deduplication is kind of planned but kind of difficult too). Updates dont really work so either you go declarative with podman compose or distrobox-assemble, or you use rolling distros. Also they share your homedir by default so they will clutter and mess up your dotfiles which is a problem nobody deals with. Dotfile backup tools exist but are kinda complex. Distrobox has a config but the creator doesnt seem to want to make it the default, neither do downstreams.
• Appimages just suck, back to the windows way but without developer signature verification (like Windows) or secure updates (like .apk files on Android)

Also Nix, Flatpak and a few more fully depend on Github. Same with uBlue, Secureblue and a ton of other projects. Really scary actually.