Yes, it may be a bit confusing. Basically the way it works is you install things on templates and then TemplateBasedVMs inherit that.
For example, by default
personal are based on the template
fedora-32. When you install software in
fedora-32, since the other two are based on it, they will inherit that new software. However this only happens after your restart
What this means in practices is that if you want to install
libreoffice permanently for your
work AppVM (a kind of TemplateBasedVM) then you install it on
fedora-32 and then restart the
work VM. If you had your
personal one running but you don’t need to make use of the
libreoffice there, you don’t need to restart it.
Hopefully this clears it up a bit.
Following the docs, software should generally be installed in Templates, yes. You can read about the implications here:
Specifically about security, there is this subsection.
If you do not trust the element software enough to have it in other appVMs based on that template, then you can clone
debian-10-element, for example and change your AppVM to be based on that one. Then, those changes will only be affecting that AppVM.