I have two things to add: one a different opinion to the original post, and the second a new suggestion.
DNS
Changing your default DNS is a great idea and I fully recommend it. However, while they are certainly quick due to both being Internet behemoths, I wouldn't say Cloudflare are a great choice and I would specifically recommend against Google, because they're both Internet behemoths with much-documented scummy behaviour.
Also, OP only mentions IPv4 DNS and only standard (see: plain text) DNS which is trivial for anyone to monitor what you're doing. There are DNS technologies which encrypt your requests like HTTPS does - DoT, DoH, DNSCrypt, etc. - to make it that extra bit harder for your ISP and various Internet behemoths to collect data on what websites you're visiting. If at all possible use an encrypted DNS, but at the very least configure both IPv4 and IPv6 DNS.
funnily enough, while Android lets you set a system-wide encrypted (labelled "private") DNS, it doesn't let you set system-wide plain text DNS addresses, and usually doesn't give you the option for IPv6 on individual wifi connections either
Personally, I use AdGuard. They provide most flavours of DNS encryption as well as standard DNS, with and without backed-in adblock and malware protection. They also have various other tools and products which I use such as an Android app, managed DNS dashboard, a VPN service, etc.
Also also, changing the DNS on your device only changes it for that device - and has to be configured manually for each network - ethernet, each individual wifi you connect to, etc. At home, you may be able to set the default DNS on your router so that all connected devices are told to use your preferred DNS provider instead of the one set by your ISP. Unfortunately some ISPs do lock down the routers they provide to customers so that you can't change the DNS, but it's worth checking.
For your phone, or if you regularly use your laptop out of the house, things are a bit trickier. Your best bet will be using a trusted VPN, or other similar software (such as what AdGuard provide) so that you can route all connections through your DNS of choice.
Packaging Formats in gnome Software
If you're limited on space, Flatpak (and Snap and AppImage) are not the way to go, as their entire reason for existing is to pre-bundle dependencies for the software so that they run on as many linux systems as possible - but this bundling results in eating a lot of your storage. It's not even possible to tell beforehand a lot of the time, as the sizes shown in gnome Software and KDE's equivalent are just for that app itself, not the supporting runtimes and other bits that will also be downloaded if you don't already have them from other Flatpaks you installed previously.
In gnome Software, a lot of apps will have a little drop-down menu near the install button where you can pick which packaging format to use. The gnome devs are famously anti-user and so not only do they prioritise anything and everything over native packages, they don't actually expose the setting to change it in the GUI.
You can, however, tell it to prioritise native packages via terminal commands if you want:
First, get the current order of preference:
gsettings get org.gnome.software packaging-format-preference
Using the "Try Zorin" option of the ISO, the default confguration is ['flatpak:flathub', 'flatpak', 'deb', 'snap']
Then rearrange your output and plug it back in using set, probably something like:
gsettings set org.gnome.software packaging-format-preference "['deb', 'flatpak:flathub', 'flatpak', 'snap']"
This won't affect the apt command, though, and I'm not even sure if it will bypass Canonical's scummy and fraudulent fake apt installers that just silently trick you into using their garbage snaps when you had explicitly asked for the native release in the Software store as they first started doing with Chrome. They're already intentionally, wilfully, and maliciously circumventing user choice with apt so I would be shocked if they aren't also doing it in gnome Software somehow, but it's worth trying.