Applications that can send commands to X.org servers can completely control it. The same isn't true for Wayland.

Flatpak is providing the actual application sandboxing, but being allowed to talk to the X server is a huge amount of privilege that can't really be restricted.

I think they're counting on flatpak.