admin No, this is wrong. It is not paired with any form of verified boot, and privileged components don't have to be part of the read-only portion. It is not a security feature.
Yes, there is no verified boot and this had completely slipped my mind, I haven't bothered to implement it (assuming I actually can) because my threat model is relatively low on my desktop PC, I guess I'm lazy and shouldn't be taken as an example.
I use a recent Microsoft Surface if I want something much more secure, of course, even if I don't like the bloat level.
On traditional Linux distributions, I've sometimes had to completely reinstall the system after a bad modification, I no longer have this problem on Aeon, I seem to have greatly overestimated the value of safety here, but the theater it offers suits me quite well.
admin I'm just forced to degrade SELinux security
I suppose I could leave the change permanently, but I'm not decided.
missing-root sandboxed apps etc.
Apps on Flathub are not really sandboxed and cannot be compared to real sandboxing like on Android.
it also depends completely on the implementation made by the application developer, a Flathub application can get all the privileged authorizations, you can slightly reduce the attack surface with something like Flatseal but don't expect much.
https://privsec.dev/posts/linux/desktop-linux-hardening/#application-confinement