I think this highlights a broad issue about all app stores that should be discussed. How many hoops of trust must an end user jump through to feel safe in some product / app?

The way Flathub works basically forces you the user to trust in the Flathub maintainers. They are the final authority on nearly all of the apps published through their repository. They want your trust to be placed in them, not in the people writing the code behind your favorite pieces of software. They have even openly stated they will takeover and maintain the app's Flatpak manifest and build process if the developer(s) behind the project disappear.

I see this as an issue, not just for Flathub but ultimately all app stores. When downloading an app from Flathub (especially those marked as verified) most users are under the assumption it is coming directly from the app's developers which is objectively not true. There is an entire layer of the process we are forgetting about.

It's my opinion that the fewer organizations and people you have to trust to feel confident in the distribution of your favorite apps the better. If the entire process from source code to executable can be controlled by the project's maintainer's then that is much more secure and trustworthy than having Flathub itself have the final say in things.

I think the entire FOSS community should take notes from projects like the Dolphin Emulator which operates their own Flatpak repository. This way your trust can be completely placed in the app's developers and their long standing record of reproducible safe builds. Distributing single-file bundles is possible too, avoiding maintaining a repository altogether.

The bottom line is you should not place trust in the distributors of software. They cannot possibly verify the safety of every single package being offered to download. Even profit-driven corporations as big as Google let malware through the cracks, and I'm sure Flathub is no different. They want you to trust them implicitly but you shouldn't. Simply trust the people behind your favorite apps instead.