Richard Brown, who's been working on this problem for 10 years at Suse, says he was wrong in 2017. Flatpak is now the clear way to go, if you care about security, app updates, licensing, and multi-distro support (runtime dependencies).
Flatpak offers convenience but it could never offer the security that the distros it is circumventing offer. Application bundling is just inherently insecure.
https://ftp.fau.de/fosdem/2023/UA2.114%20(Baudoux)/container...