You're constructing an argument the person never made.
The binary for my app could live in a hypothetical /apps/bob.
Its config could be in there too.
There's no need to duplicate dynamically linked system libraries in there.
If the app need a different version of a library than the one provided by the distro/os, it could vendor it (or link statically). Optionally it can vendor and still try to use OS version if they version is satisfied, but this is just a memory optimisation (disk isn't that expensive).
There's also no need to place firewall rules in there. I'm not sure where you got that from. Firewalls are beyond the scope of a single application?
As for making thing system-wide available, there's already a few solutions for this (symlinks being a very backwards compatible way of doing this on nixes).
For all its faults and poor UX execution (albeit, maybe things improved since I last used them) flat pack and snap have some good ideas!