This is kind of a thing of the past with Flatpak, since apps can only create files within their sandbox's $HOME, which isn't the same as the user's $HOME. Now we just need deb/rpm/etc apps to be sandboxed in a similar way using bubblewrap (the tool Flatpak uses for sandboxing).