I am not so sure this really establishes that Firefox in a Flatpak is less secure. From the linked bug:

You lose the namespace isolation, and by extension the chroot, but that's it. It's definitely nice to have, but to say it's "most" of the sandboxing seems a misrepresentation. Note that some distros disable the kernel support for them by default, so that's what they currently get regardless of Flatpak.

It might be more accurate to say that some per process isolation features don't work because flatpak uses them to isolate Firefox from the rest of the system. This could make it easier to smuggle data between processes in Firefox. It reads like a trade off to me and the impact depends on your security model -- whether you value interprocess isolation more than isolation between the app and the system.

Either way, interesting find! I didn't know some of Firefox's sandboxing is precluded by the Flatpak sandboxing. I edited my comment to dispell the claim that it's more secure.