> Just pretend that all Flatpak apps were statically linked. Would you have the same complaints?

Yes. The work required to backport and test security fixes in any library or any other component in every stable release train of a flatpak (or a fat binary) is simply not being done.

Most upstreams barely handle vulnerabilities affecting #head.