To me, the weakest link in the Flathub (@Flathub) distribution model has been the lack of information on the reproducibility of any package. Essentially, it's impossible to know whether any app distributed on Flathub is completely free of binary blobs; as a result, it wouldn’t be hard for malicious code to sneak in.