Docker image layering and nightlies for the heavier installs has worked pretty well for me. Dependencies from things like npm, composer etc are all build time still but more of the base stuff is on a weekly build cycle. We just do notifications if the nightlies fail to manually resolve it which is very very seldom
I wouldn’t use it for security, use VMs if you need isolation.
I used Distrobox for various dev projects on Fedora Atomic and it worked great for that. I did a separate homedir mainly just to avoid dumping a bunch of crap into my real home but definitely have the expectation that anything you install has full access to the system.
I run FreeCAD via Distrobox as well since the flatpak performance was pretty bad and it’s wayyyy faster which is nice and preferable to rpm-ostree in my instance.