It provides a sandbox, an API to access stuff outside of it (portals), and standard tools to customize what your software has access to (Flatseal, KDE app settings). It's based on the same technology as Docker containers, but for user-space GUI apps.

AppImage is a binary distribution format that does none of that stuff, so you need external tools, like firejail, to limit what the application has access to.