Where to draw the line is fuzzy and probably subjective, but to me it seems natural for "system" packages to be updated and managed entirely separately from user-installed packages of all kinds (not just things that get wrapped in flatpaks or shipped with their jungles in Docker), even if that means dependency redundancy. I think for most people trading off some storage for assurance that user packages can never ever influence or worse, break the environment would be worth it.