Distributors entering Flatpakland

> where every software needs to be upgraded by itself, so every package that is not under active development turns into a security nightmare

A package does not need to be "under active development" to be rebuilt. Sure, it's faster and easier not to have to rebuild it at all but there are drawbacks to that approach too: the most obvious and best known is the difficulty of having multiple versions of the same library in use at the same time (by different packages). For more drawbacks see the article.