Flatpaks are more and less secure. Their Sandbox improves 99% of apps security as other sandboxes are hard to setup and thus nearly nonexistent.

Browsers have their own, so just dont use Flatpaks there.

I am not sure about microcode, but processes running as root are maybe more critical, but it sounds like any process could have exploits if microcode is a problem. Also, RiscV or even ARM will be waaay better here, as their instruction set is not dozens of years old and extremely bloated.

As we get our apps from secure repos, with projects keeping track of every Git commit etc, we just had no malware really.

The only problem is that Flatpaks, like appimages, "just work" and dont have to evolve like the rest of the OS will. Their main goal is to work everywhere, and Devs always choose convenience over security.

For example Portals are not implemented in most old big projects like Libreoffice, Gimp, Inkscape etc. Scribus is even X11 only. But developers will not remove the filesystem=host permission and replace it with "just all the media locations". This will still be a problem, but at least apps could not read Kernel logs etc anymore.

Also as they "just work" its easy to abandon them and dont update. The "outdated Runtime" Warning is a veeery good indicator of a project using old and probably insecure libraries. But afaik there is no automatic CVE patching in flatpak-builder which is a huge problem.