Good list. I would add requiring snapd, which runs as root, to do anything with snap packages. You need to open up an entirely new potential attack surface just to use snaps.