IMO you're exaggerating a bit, but there's quite some truth in there. Flatpak has some security features and is by itself not a bad design, but the ecosystem's current state isn't really utilizing those.

Snap is a whole other can of worms. The ecosystem is like canonical's personal play store/app store.