

So you linked to apt.
I guess good for anyone who finds this interesting…
But more on topic here is is a link to answer from 2020 from an flatpak maintainer:
If a user installs or updates a specific app-id the code verifies that:
- The new app is gpg signed by a trusted key
- Checksum verifying that all files are untampered with
- The new app has that app id
- The new app has a later timestamp on update
You are not arguing in good faith.
I have linked multiple times to the docs and to the GitHub repository of flatpak.
Now how about you link to something useful in the docs that proves your point or maybe just a random article as source to your misinformation.