>using [SELinux] on the desktop is vastly overkill.

The ChromeOS project disagrees with you: ChromeOS uses SELinux to help sandbox the browser.

And Android uses it to help sandbox apps if the AI assistant I use is not making stuff up.