This is absolutely a false assertion. If your distro integrates flatpak then you will be prompted to update the runtimes. If you manually installed it then it’s

This is absolutely a false assertion. If your distro integrates flatpak then you will be prompted to update the runtimes. If you manually installed it then it’s on you to update things. Now if the dev bundled deps then yes there is the possibility that they neglect to update those. But this situation is improving as runtimes add more popular deps, baseapps are also a new way to share bundles of deps which could reduce that burden. Repositories can also scan flatpak manifests and flag issues too.