I will try it out after work. Do you know a way to provent automatic openings instead of librewolf? I'm currently using Hyprland and was using the appimage so it doesn't have any conflicts.

Flatpaks are more and less secure. Their Sandbox improves 99% of apps security as other sandboxes are hard to setup and thus nearly nonexistent.

Browsers have their own, so just dont use Flatpaks there.

I am not sure about microcode, but processes running as root are maybe more critical, but it sounds like any process could have exploits if microcode is a problem. Also, RiscV or even ARM will be waaay better here, as their instruction set is not dozens of years old and extremely bloated.

As we get our apps from secure repos, with projects keeping track of every Git commit etc, we just had no malware really.

The only problem is that Flatpaks, like appimages, "just work" and dont have to evolve like the rest of the OS will. Their main goal is to work everywhere, and Devs always choose convenience over security.

For example Portals are not implemented in most old big projects like Libreoffice, Gimp, Inkscape etc. Scribus is even X11 only. But developers will not remove the filesystem=host permission and replace it with "just all the media locations". This will still be a problem, but at least apps could not read Kernel logs etc anymore.

Also as they "just work" its easy to abandon them and dont update. The "outdated Runtime" Warning is a veeery good indicator of a project using old and probably insecure libraries. But afaik there is no automatic CVE patching in flatpak-builder which is a huge problem.

FOSS nowadays isn't the same anymore since BigBrothers entered this world, first Google and Microsoft, the latter even acquiring GitHub, FOSS is no longer the same as it was a few years ago. Many companies no longer focus on communities, developing their products tangentially to the user more in their own interests. In the world of browsers, there are already more than 100 on the market, forks of Gecko, Blink and Webkit, some exotic ones aside, like Otter, which is also fighting for its life to avoid passing to the more than 70 browsers that were abandoned and discontinued in this Browser war that exists, where everyone fights to survive against the great Mainstreams Chrome, EDGE, or the Chinese Opera.

I have been using Vivaldi for more than 7 years and I have seen Google's tricks to eliminate it, even leading to the point that the Vivaldi team removed the Vivaldi UA, disguising it as Chrome, against their own interests, so that the user not getting blocked by Google services and related pages with the argument "browser not compatible" which was absurd. Since then there has been a continuous war against Google's attempts to control this browser, which has until now always resulted in Google coming to hit the teeth on a rock, (IdleAPI, FLoC, and other crap)

Meanwhile Mozilla made a contract with Google, for using Google as main search, apart from sending Data of the accounts to Alphabet, googletagmanager and googleanalytics to survive. That is the value of FOSS today, not the user or the community, nor the ethics or transparency of the company.

FOSS is important, yes, for devs who want to launch another fork more, but not so much for the normal user, for this it counts excellent support, an active community, a real interaction with the devs and the team, honesty and ethics of the company. But yes Vivaldis 5% of the script of its unique UI is proprietary, to avoid that Google, EDGE or Opera can fork it, same with Brave, it also isn't fullOpenSource for similar reasons (see its TOS about copyrights) Other engines are easier to go OpenSource, because Chrome or EDGE can't fork it for the own browsers. It's not the same problem.

Not all what is proprietary soft is crap nor all FOSS is the panacea, it's by way not so simple, with ugly surprises when you walk with fixed ideas