It is simply correct - they are.
many flatpak packages contain filesystem=host, filesystem=home or device=all permissions - Which you know this because you must use them for Flatseal. Plus, many applications would be hopelessly broken without them, due to their inability to communicate with the rest of the system.
Which some flatpaks still actualyl struggle to do...
I have no idea what you are doing in your screenshot... It makes no sense.
That is fine, as long as they make Honest Commentary as they go...
Claiming that major security hole was a Minor Update does not do this.