> This is not a security risk of flatpak but of the application. Developers are responsible for releasing updates, not flatpak

If it was a regular application installed by a linux package manager, the dependencies will be automatically updated to fix security issues(At least in most cases).