I have already been using bubblewrap[1] to isolate KeePassXC from the network and more (the only access it has is to its own private directory and a hardened Wayland socket[2]). I wouldn't recommend relying on devs or maintainers to do application isolation work for you.

[1] <https://github.com/containers/bubblewrap>

[2] <https://git.sr.ht/~whynothugo/way-secure>