So often, a distribution would be held back on an old ffmpeg (perhaps patched with some of the CVE fixes by a distro maintainer who might not be familiar with the codebase) to isolate the churn of upstream.
flatpak lets app maintainers update at their leisure, which actually gets them on a faster update cycle.
https://github.com/search?q=org%3Aflathub+%22--filesystem%3D... https://github.com/search?q=org%3Aflathub+%22--filesystem%3D...
So, many applications use it as a distribution mechanism and not so much for sandboxing. Of course, this is bound to get better over time when applications are modified to support sandboxing better and can use portals.
IMO you need both: isolation through e.g. sandboxing and timely security updates of applications and all their dependencies. Flatpak currently provides the former for some applications and the latter is completely dependent on the maintainer of the Flatpak.
- VLC ships with a slightly older version of ffmpeg (4.1.3) with two known CVEs:
https://github.com/flathub/org.videolan.VLC/blob/f1b27c13b13...
- MakeMKV uses an outdated ffmpeg (4.1.0), which has several known CVEs:
https://github.com/flathub/com.makemkv.MakeMKV/blob/3c44c8bc...
- Openshot uses an outdated ffmpeg (4.0.3) which has several known CVEs:
https://github.com/flathub/org.openshot.OpenShot/blob/ec2077...
This is what you get when every application ships custom dependencies, rather than having a consistent package set.
(I like the idea of Flatpak, but I think it hasn't found its optimum yet in terms of dependency management.)