In my eyes, this adds another potential point of failure outside the control of the developer of a given tool.
On the contrary. The Fedora maintainers saved all their Audacity users when audacity introduced a spyware in their build. The flatpak had the spyware for months while the Fedora release of audacity was made secure by the maintainers. I value this, if you remove the people doing it then you remove value for everyone. It all comes down to how much you value your privacy.
Windows has a fantastic model where every software just work. It's great! The result is an abomination of devs stealing your data or doing whatever mess on your computer. "Free software" was synonymous of red alerts and we used programs like Adaware or whatever cleaner software. Each months there was another new cleaner utility. When was the last time you cleaned your distro?
Try to expand the scale of flatpak and you'll see that you will hit the same problems that any other distro.