> It's worse because you're likely to install more packages using something like Flatpak than you would by downloading random binaries or building from source.

... what makes you say that ? if I want to run something, it'll run one way or another no matter how hard the "system" wants to prevent that. Even if it's patch.exe downloaded from a 2004 russian website.