The permissions have to be justified when uploading to flathub (via PR) and the exceptions are not always accepted. Flatpaks ARE safer than system packages and if you think otherwise I recommend you taking a look who can access all passwords on the keyring and who doesn't. (Getting such exception on flarhub is very hard). Flatpak 2.0 hopefully gets user approvals for permissions. But still with current flatpak you have the option to reject permission via flatseal.