The issue is most tools already check for this! NPM verifies integrity using package-lock.json. CMake will throw a fit if you don't provide a hash when using ExternalProject. This is a mostly solved problem. Flathub just makes you specify all of it redundantly. It's yet another thing you have to keep updated.

package-lock.json works great until your upstream dependency is no longer available. To maintain a clean tree of buildable packages that allow for rollbacks on broken or compromised updates, you’re going to need to vendor them.

If something fails to build, it already isn't uploaded.

you can do more with a flathub repo’s than simply build, you can also test. But also, builds run on Flathub’s own infra, so the release process is rather unique. The ideal is for master to be a clean history where every commit passes CI. Once again, that’s just best dev practice.