A myth propelled by people who don't understand security continually saying "Anyone can read the code, therefore it's more secure".
[0] - https://old.reddit.com/r/GrapheneOS/comments/bddq5u/os_secur...
Also why not recognize the strides Wayland made for security in the desktop? Very handwavey take.
And yeah, I don't understand his hate on Flatpak unless he means the sandbox is too user-hostile. So many things break with Flatpaks, from native messaging hosts (think browser extension talking to desktop application) to theming to local folder access to pasting from the buffer.. it's quite a draconian sandbox.