People have stuff to get done. If you disallow unprivileged filesystem mounts, they will just use sudo (or equivalent) instead. The problem is not that users are mounting untrusted filesystems. The problem is that mounting untrusted filesystems is unsafe. Making untrusted filesystems safe to mount is the only solution that lets users do what they actually need to do. That means either actually fixing the filesystem code, or running it in a sufficiently tight sandbox that vulnerabilities in it are of too low importance to matter. libguestfs+FUSE is the most obvious way to do this, but the performance might not be enough for distros to turn it on. For ext4 and F2FS, if there is a vulnerability that can be exploited by a malicious filesystem image, it is a verified boot bypass for Chrome OS and Android, respectively. Verified boot is a security boundary for both of them, so just forward syzbot reports to their respective security teams and let them do the jobs they are paid to do.
