When looking at this aspect, I think it's important to remember that users can often conflate apt-from-the-distribution with apt-from-a-third-party-repository.
What you've said is true if a user is using a distribution-provided package using apt.
If the user has installed from a third party repository using apt, and that repository has bumped the version of a library because it needs a newer version (this is quite common), then the user is dependent on the third party author to fix the library for security, just the same as a flatpak or snap.
However, in the case of the snap (not sure about the flatpak), at least the impact of an insecure library is limited to within the sandbox. Third party apt repositories do not benefit from any sandbox.
This is perhaps obvious to you, but I think it is misleading to users in general to not separate the two cases. "apt is great for security because you don't have to wait for the upstream author" is not true for third party repositories.
For Flatpak the updates are automatic, at least on the version I'm using with Debian Buster.
In my opinion they care enough about vulnerabilities (but I would say it depends on the packager), currently the Flatpak Evince doesn't have support for PS files (so for now only PDF) for security reasons (I don't recall the details, it's about the Ghostscript interpreter, there's an open issue on the BTS).
Edit: the issue https://gitlab.gnome.org/GNOME/evince/issues/1058
When apt updates libxyz.so and fix some vulnerability (think of exploits for JPEG decoding libraries) you have to wait for the authors of the appimage, flatpack and snap to distribute a new version with the update. That's likely to happen after apt did its job. You'll be vulnerable for a longer time.
I confess that I don't know if those other formats autoupdate like apt does or it's a manual user operation. In the latter case, you might be vulnerable for a long time. So, which one you can trust most? The one that autoupdates, if any.