Aside from all the things Flatpaks get right, a sandbox framework built right into the design is a major win and in my case, it's one of the big reasons I went with it.

You can also modify the build script for any flatpak's manifest and create packages with flatpak-builder. May not be as easy as PKGBUILDs but it's certainly possible.

The problem of bad software defaults is easily solved with Flatseal. My point is that, it takes a few clicks to deny permissions to Flatpak applications as opposed to sandboxing a traditional app yourself.

Writing sandbox profiles for apparmor or something similar is usually a complex elaborate affair. And even when you do finally manage to get a working profile, it still requires maintenance to keep the sandbox functional as the target software updates. You won't face any of these problems with Flatpak's bubblewrap.