Snap makes a distinction between a minimal set of critical core system dependencies, and application dependencies.
So on every system with a snap, there is also a 'core' snap, which has the base root fs, including glic, libssl, bash, etc. This core snap is updated regularly by its publisher (just Canonical's ubuntu core snap right now, but nothing stopping some other core snap). So a lot of critical updates are applied by default, as per normal distro policy, but just in a better way (rollback, transactional, qa, etc).
The application snap is only responsible for keeping its own dependencies up to date, it uses the base libraries from the core snap. It's distinct from docker in this way, it tries to define a line between core and app dependencies, to get the best of both worlds. I.E. critical components are updated ASAP by the disro security team, but apps are free to use a specific version of a library (e.g gnome, qt) that they want to use, rather than being stuck on the distro maintained version. Which, of course, they can still use if they want :)
It does push the burden on updating libraries to the app vendor, but on the flip side, snaps run in a very confined environment, which mitigates the scope of most CVEs there might be in an older library.
A lot of careful trade-offs considered and involved in the design - we'll see they're the right trade offs or not :)
And then as soon as an app decides to not use the base version of a library, it will still be vulnerable when you update the base snap, so you still need to check every app for updates. That's not an improvement at all.
AppImages even more so then. For the end user though either are simpler and allow people to get up to date versions of their apps, which is difficult when using shared libraries. Plus Snaps are also cross-distro which saves a lot of work for authors.
Of the ones I looked at NIX looks particularly promising, having dependencies based on checksums sounds pretty cool.
If you don't like that, you can install snaps from a local file (in which case you need to handle updates yourself), or run your own snap store (I think some assembly still required)
Snaps might be good for deploying big complex things. But in case of smaller "apps" like some featured in their site (VLC, Blender, Krita...) this seems like a lazy solution. Lazy because we loose control over knowing which libraries are running in our system.
For example, if there's a security issue with libssl, I can quickly patch my libssl instances with apt, pacman or whatever my system uses. But with snap?
I think the way forward is the nix way [1]. It's a bit harder, but it pays off. Some big HPCs use it already, and it seems to work quite well.
[1] https://nixos.org/