Verifying an app on Flathub is a simple and open process that only requires to upload a file into the .well-known tree of the developer website: https://docs.flathub.org/docs/for-app-authors/verification
At the same time, I think that the verification mark does not work as some people may expect. Flatpak has become a popular way to sandbox privative apps that are non-free Electron dumb frontends that interact with a cloud SaaS. Discord is a verified Flathub application and it probably sends information about the computer such as the list of process as part of their telemetry.
The point is that this verification process will prevent running apps that have been packaged without the knowledge of the original developer (someone packaging malicious code inside existing apps and deploying them to Flathub), but it will NOT prevent running apps that have additional surprises placed by the original developers in first place.