[iotku]

It's greatly improved with Flathub's "Verified apps" [1] implementation, but you can make similar arguments about downstream packaging (e.g. from distros) not being clear about being independent of "offical" builds.

It's also very worth noting that `Fedora's Flatpaks` are sourced separate from the "Main" `Flathub` service which most people expect flatpaks are generally being sourced from which has many "official" flatpak releases of software directly from projects leading to extra confusion.

Flathub itself is fairly auditable (but not trivially so) and built through their CI, but I still agree that the unofficial packages are often of questionable security/quality.

That said, Many of the "native" (e.g. not Flatpak) distro packages are using far from supported/official builds with often missing/broken features and it's an unreasonable support burden when nearly all of issues related to distro packaging end up on the upstream issue trackers/support channels.

It's especially troublesome when the upstream has official builds available and it's unclear to the user reporting issues that they are not actually using official builds.

[1] https://docs.flathub.org/docs/for-users/verification/