Can we please, in the year of the lord and savior, stop linking to flatkill for once? They have been debunked at least 5 different times at this point, so let me link to a couple of them: https://orowith2os.gitlab.io/posts/Flatpak-an-insecurity-nightmare/
https://theevilskeleton.gitlab.io/2021/02/11/response-to-flatkill-org.html
Some of your points aren't bad, just not up to date to what most of the ecosystem has been doing for a while now.