GTK 4.0

> But GTK2 has reached end of life, so you can’t bundle it

GTK 2 reaching end of life means that the GTK developers are no longer willing to take responsibility for it. If you *are* willing to take responsibility for it, or at least for the subset that's used in your application, then nobody is stopping you from doing so. (Indeed, the license is irrevocable, so nobody *can* stop you.)

> If [...] there is no reason not to keep shipping the library, then you may equally well ship it as an rpm or deb package

As a downstream maintainer, I'm not exactly enthusiastic about taking responsibility for GTK 2 longer than the upstream developers do, for approximately the same reasons they have announced its EOL: every hour I spend on maintaining GTK 2 is an hour I'm not spending on something more widely beneficial, or more rewarding.

Debian will continue to ship GTK 2 as a .deb for a while, but eventually we too will be unable or unwilling to take responsibility for it. If you want to ship a third-party .deb outside Debian, or bundle it in a Flatpak app, it's up to you to maintain that in a way you are happy with (it seems to me that bundling it in a Flatpak app would be a better way to make it clear what uses you are and aren't taking responsibility for, but how you use your time and effort is not up to me).