XDG directories for macOS dotfiles is my hill to tilt windmills. To make it extra fun, my $HOME directory is immutable: chflags uchg "${HOME}" (Simply setting it read-only would work too.) Preventing arbitrary writes in $HOME breaks things, but it's actually quite rare. I should document this setup. Or perhaps it's better to keep the madness to myself...
FWIW I use firejail so applications cannot run anything in $HOME and temporarily (heh) mounted tmpfs (two separate options).