This is one of the reasons I use Flatpak for all apps that are available via Flatpak. I’ve disallowed all Flatpak apps access to the root of my home directory via a global override, so anything they wanted to do in there (e. g. create folders, place malicious code in my ~/.bashrc, etc.), actually happens in ~/.var/app/<appid>/.