Interesting. It's my understanding that flatpaks deliver the app as close as possible to the way that the developer intended. With an rpm, someone had to go and take the app from the developer and make it into an rpm, so there's an extra step there.

For sandboxing, yes, flatpak does do a really good job of that. Otherwise, apps would get sandboxed on Linux with either SELinux or AppArmor.

For security, flatpaks give you the latest version of a package and updates come in automatically, so I view them as being very secure.

Please point out any errors with my reasoning (open invitation to anyone). Thanks!