This is like hating Flatpaks because they’re sandboxed

1. the sandboxing has been shown to be weak, so they’re not even that
2. the hate I hear for flatpaks is the same as for tarballs: it’s an out-of-band install which doesn’t coordinate with the single source of truth on the host. If that’s a weird phrase, or if you don’t know what ISO27002 is without looking, then you won’t care.