My experience with flatpak has been stellar from a technical perspective has been stellar.
Where it currently falls short for me personally is trust. With my distro I am putting my trust into the maintainers, but with flatpak its… random people for most apps?
It is tough when it is not a primary channel of distribution for most devs, but I am optimistic that will change in the future.
Sandboxed just means an app can’t reach out to the rest of the OS. What about the information I am entrusting to it to process?
If my browser is a flatpak, it likely has access to most of the information I care about. If I am using a chat app that is a flatpak, it can read my most personal communications. Why do I care if it can read what is in /etc?
Relevant: https://xkcd.com/1200/
You totally missed my point. My point was that a lot of flatpaks are packaged by unknown third parties. I would love it if the devs would package things as flatpaks directly, but that is mostly not the case.
Looking at flathub right now. 1567 applications are from unverified publishers vs 789 verified. Unverified apps include chrome, edge, chromium, brave, BITWARDEN and signal. All of those applications process highly sensitive information.