alt Hacker NewsTwo more things to note about impact assessment: Flatpak uses the selected runtime's baked-in trust store (I think), so any apps may be susceptible even if you update the system package. Containers also don't inherit the host's trust store and use the one from the base image.
If the application uses p11-kit, or a TLS library that uses p11-kit such as OpenSSL, NSS, or GnuTLS, then Flatpak should automatically give it access to the host system's CA certificates.