if yoy fuck over with the default package manager, the attacker has your system, if you fuck over with flatpak, they have your browser cookie, my point still stand

sure, nothing beats good security hygiene and habits, but another security layer(plus others flatpak benefits) are a good thing