[_0w8t]

In theory one gets better security. Distribution or manual apps can access and modify everything the user can do. Flatpack and Snap tries to address that with a security model similar to mobile apps.

In practice for many apps the security protection is non-existent or very limited for compatibility reasons. So for now the benefits is indeed mostly a store model and auto updates.

If one really needs to run an untrusted app a VM is probably the only practical way. It is also possible to run apps in various containers, but truly secure setup is rather nontrivial with those.

[emerongi]

Flatpak apps usually come with quite open privileges, however the user can completely configure this themselves and restrict the access of an application to quite a reasonable degree. Unless you distrust the sandbox of Flatpak, I don't see a need for containers.

[AnIdiotOnTheNet]

Worth noting that Flatpak's sandboxing is using the same container functionality of the Linux kernel as all the various other container tools. If containers are secure enough than so is Flatpak, assuming you've tweaked the applications sandbox settings to your liking.