If you run Windows, OS X, Android, or iOS it's 100% likely that you have several different versions of some C library that have known vulnerabilities in them. Think about things like proprietary games that aren't updated often, if ever, where things like libpng and stuff get bundled in. When the upstream libpng developers release a security fix, do the game developers release a new version of the game with that fix included? Almost certainly not. This is the problem with bundling. You are dependent on N upstreams for security updates to any given non-core library. It's a rampant problem, and it's a problem that GNU/Linux distributions address for the safety of their users.
>For example, when the "gotofail" bug was discovered in the OS X system crypto frameworks, Apple issued an OS update that ended the story right there.
Right, that is good. All of the applications were dynamically linked against the system's openssl, so the security update was easy. But only a few things are like that on these proprietary operating systems. GNU/Linux distributions, on the other hand, have this property for all software. It's absolutely crucial for user security.
Asking users to install these new Flatpak/Snappy/Docker things is asking them to accept a bunch of software known to be insecure. Running vulnerable software in a container doesn't make it much better. We need to develop systems that make it easier to run software that has all of the latest security patches. Tools like Flatpak are a bold step backwards.
Also Flatpak does contain the extent of damage by putting the application in a sandbox - different in implementation detail but hardly different conceptually than how Apple "app store" apps likewise run sandboxed with minimal interaction between apps allowed.
I mean an application that breaks sucks, and you might have to roll back an update or wait for a patch. It is annoying and you may lose some time.
A security breach may be more rare, but it also might be much more damaging. You might lose your whole business or worse.
The right answer is probably some subtle equation of both problems relative to one's specific circumstances (trade offs) but "it depends" never makes for a good internet argument so most people don't bother with the nuances.