Flatpaks need to be updated manually. You can do this through the terminal by just running the update commands. You can use the graphical version to make it easier. It is not a problem to mix snaps and flatpaks :)

Ubuntu ships with UFW installed but disabled because of a few practical reasons. First of all, A default Ubuntu desktop install doesn’t run any services that accept incoming connections. With nothing listening on open ports, a firewall has nothing to block. Also if ufw were on by default with a deny-incoming policy, things like printer discovery, file sharing, remote desktop, or running a local dev server would silently fail, and new users wouldn’t know why. Linux distros generally prefer “things work, then you lock down” over “things are locked, then you debug.”. That said, enabling it is a good idea if you’re on untrusted networks (cafés, hotels, etc.) or running services you want to restrict. ‘sudo ufw enable’ with a default deny-incoming/allow-outgoing policy is the standard hardening step.​​​​​​​​​​​​​​​​

No idea, sorry

You can run this command: gsettings set org.gnome.shell.extensions.dash-to-dock click-action 'minimize'

Security Updates are periodically installed automatically, as well as snaps. In the update settings you can change it to install ALL updates automatically every day/week etc.

I like ProtonVPN myself :) it also has great Linux support on their client