.... and still you need something to run those apps and utils like Signal or Threema and those will never get into the base system. It wouldn't make sense. And you don't want to burden the developers of that software to have to package their software n+1 times for every imaginable distribution.

Thus Flatpaks isolation and sandboxing of apps using "dbus based" security, pipewire and polkit.

Two sides of the coin of a stable and extendable system.