From the article:

> The flatpak runtimes and apps do not get security updates

This is exactly what I worry about with things like Flatpak and Snaps (Ubuntu).

Instead of having the distro maintainer provide timely security updates, all they have to do now is shrug and point at the external package maintainer. So now instead of simply backporting a patch to the distibution's openssl library, every single app maintainer of each app that uses it has to do this and provide an update. This is clearly not going to work as well.

And while sandboxing is a great idea, it can be done using other methods too, like SELinux or AppArmor.

Not to mention the wasting of resources by running all those separate versions of each library.. But that's not security-related discussion.