I don't know if this is still the case, but IIRC browsers (chrome and Firefox) have their own sandboxing which is quite effective, but their efficacy is hindered by flatpak.
I've used silverblue on my gaming rig for over three years now. It has been a completely uneventful experience, so I really like it.
The only pain point I have is that compiling kernel modules is an utter disaster and it's ridiculous that there is not a seamless mechanism for this yet. Every kernel update (and there are tons) requires me to rebuild my third party modules, but you need to do it in a toolbox and the kernel headers version must match the running kernel version, which is actually more annoying than it sounds.
Our current understanding having spoken to systemd developers is that we should be able to find a path that brings us much closer to upstream, if not entirely.
The only way the systemd developers will allow musl support upstream is if musl supports the glibc-isms that systemd uses.
They have been extremely clear that they will not carry patches for other libcs.
This shit started on Tumblr