[newnewpdro]

This is what happens when you try escape "dependency hell" by turning the host into a composition of hosts-per-application.

Now you have a clusterfuck of dependency islands which all need updating and have their own unique sets of CVEs and upstream release schedules and policies.

It's not really flatpak-specific, this is the reality of containers (in the image/rootfs software distribution sense, not namespaces+cgroups) in general.