They are also adding per-application isolation of settings:

https://blogs.gnome.org/mclasen/2019/07/12/settings-in-a-san...

Flatpak is one piece of a broader design to secure Linux workstations. It is also intended to work in conjunction with Wayland and the in-development Pipewire. These lock down video and audio respectively, so that shared resources can't be misused by applications.