As much as I hate to say it, the Qubes OS people were right. The solution is aggressively isolating apps into virtual machines. Anyone know how much my battery life is going to suffer if I bite the bullet and switch?

Yes, "untrusted" "app stores" should be sandboxed (including AUR, FlatPak, ...) Probably with a VM, at least as a default/option.

Flatpak