The best solution is separate hardware and network isolation for each level of trust.
Virtual Machines are the next best thing especially when integrated like qubes-os but may someday be susceptible to hardware bugs (rowhamer, speculative execution, firewire), or software bugs.
Containers can set a bunch of kernel security features (SELinux / AppArmor, unshare, chroot, etc) to isolate a process without the overhead of a VM.
Keep in mind there are simple solutions available to the motivated;
So it's best to just not have access to assets you don't need access to.
Personally I use a mix of the above methods; dedicated hardware for the real sensitive bits, VMs for anything not from debian/fedora, Pixel 2 Phone (only option with software updates worth mentioning) layered security (firewalls, intrusion detection systems, etc)
prism-break is a nice collection of software recommendations