I see that it can be slower because of having all the dependencies included with the flatpak itself instead of relying solely on whats installed on the system. I read that this means it isolates or sandboxes itself from the rest of the system.
Does this not mean that it can’t infect the rest of the system even if it had malware?
I have seen people say that it isnt good for security because sometimes they force you to use a specific version of certain dependencies that often times are outdated but I’m wondering why that would matter if it was truly sandboxed and isolated.
Do they mean that installing flatpak itself is a security risk or that also specific flatpaks can be security risks themselves?
No. Packing its own libraries wouldn’t make it slower. If anything it would be the extra access checks added by the sandbox (which is optional FWIW, apps don’t have to use it). I haven’t ever used Flatpak but I would assume the sandbox impact is minimal if at all noticeable.
There aren’t any “extra access checks” to my knowledge. It’s just the same regular access checks applied to a different set of circumstances.
It is a container so any access to the outside system is passed though.
There are XDG portals but those are just standard ways of accessing a resource.