You usually find software on https://flathub.org/ The flatpak command line tools also gets it by default from there.

Generally it's best to use the software provided already by your distros because it's more vetted than flathub. Use flatpak for stuff it's not provided by your distro.

Flatpak apps are usually sandboxed so they won't be able to fully take over your pc if you read the permissions they ask. You have to triple-check the permissions they require during installation, because they will be shown only at that point.

If you want to restrict or widen the sandbox I reccommend flatseal https://flathub.org/en/apps/com.github.tchx84.Flatseal

Also, like any 3rd party software on any operating system, you can't know for sure if they are mining bitcoin or abuse your internet. Even websites can make your pc or phone mine crypto or try to launch DoS attacks. Be careful, look at reviews and check the permissions tgey ask for, like you would do with mac os/windows software.