Distributors entering Flatpakland

Yes they can be "whatever blobs" but that's true of dpkg and rpm too. The enforcement is at a distro policy level, not part of the tool. Indeed Fedora's flatpak repos enforce a similar policy to their RPM repos. But flatpak is more lax.