The key here is which of the formats can I trust the most? Which one of these are likely to betray me?
You could argue that there is a freedom with AppImage that you are not bound to a Store. But that would not be correct, because you can self-host both snaps and flatpaks, if you really need to.
With snaps, you have more fine-grained security privileges. For example, "httpstat" [1] is a network utility to benchmark the access to a website. As a utility, it only requires access to the network. With snaps, the packager can only permit access to the network, and no access at all to the user's files or anything else.
And this is limitation of Snap and Flatpack - both stored in centralized stores.
AppImage is fully independent from any centralized stores, so developers could distribute own apps as AppImage-package directly to users.
https://blogs.gnome.org/alexl/2017/02/10/maintaining-a-flatp...
And if you do not like the "default" central store, you are free to distribute yourself the individual snap or flatpak package. Just like with AppImage.
Regarding the reference to "like mounting the CD ISO" for AppImage. All three of them actually mount one or more filesystems in order to install the package.
When apt updates libxyz.so and fix some vulnerability (think of exploits for JPEG decoding libraries) you have to wait for the authors of the appimage, flatpack and snap to distribute a new version with the update. That's likely to happen after apt did its job. You'll be vulnerable for a longer time.
I confess that I don't know if those other formats autoupdate like apt does or it's a manual user operation. In the latter case, you might be vulnerable for a long time. So, which one you can trust most? The one that autoupdates, if any.
When looking at this aspect, I think it's important to remember that users can often conflate apt-from-the-distribution with apt-from-a-third-party-repository.
What you've said is true if a user is using a distribution-provided package using apt.
If the user has installed from a third party repository using apt, and that repository has bumped the version of a library because it needs a newer version (this is quite common), then the user is dependent on the third party author to fix the library for security, just the same as a flatpak or snap.
However, in the case of the snap (not sure about the flatpak), at least the impact of an insecure library is limited to within the sandbox. Third party apt repositories do not benefit from any sandbox.
This is perhaps obvious to you, but I think it is misleading to users in general to not separate the two cases. "apt is great for security because you don't have to wait for the upstream author" is not true for third party repositories.
For Flatpak the updates are automatic, at least on the version I'm using with Debian Buster.
In my opinion they care enough about vulnerabilities (but I would say it depends on the packager), currently the Flatpak Evince doesn't have support for PS files (so for now only PDF) for security reasons (I don't recall the details, it's about the Ghostscript interpreter, there's an open issue on the BTS).
Edit: the issue https://gitlab.gnome.org/GNOME/evince/issues/1058