I think the only negative aspect of the approach is the sheer quantity [1] of package installation options available.
[1] https://docs.bazzite.gg/Installing_and_Managing_Software/
I don’t see how it’s significantly different than the status quo on Windows/Mac.
Flatpaks at least have a sandbox that can be easily configured to protect the user, does not require elevated privileges and get some limited vetting on flathub. Not to mention additional security feature like portals.
With distributions packages, there's a bigger barrier to entry which is at least better in avoiding sneaky malware from easily creeping in.
I think someone running Linux wants low barrier to entry as a reason to use the system. They want a system built by communities and not by corporations with walled garden toll booth business models.
But this point is extremely weak either way when you compare to the Windows barrier to entry which is effectively zero. Or you can compare flatpak to Mac users installing software with Homebrew.
I think if you look at flathub there are very good explanations on each piece of software regarding whether the author is verified, what the license and code availability status of the package is, and which permissions are being used when installed. It seems to use relatively strong language to describe permissions features as potentially unsafe.