Which many would consider a security issue.

Elevating privileges in general is a security issue by itself and doesn't matter how you do it, only how you mitigate the potential disasters. User namespaces is another security issue that will never exist in any of my kernels.
I've been doing this for a long time well before flatpaks existed, I'm well aware of the potential issues and have spent many months developing the correct strategy to deal with it. The biggest hazard is not the capabilities, as long as you drop everything you don't need while doing a specific action (e.g. holding CAP_DAC_OVERRIDE is a REALLY easy way to shoot yourself in the foot). The dangerous part is your program logic and how it sets up the environment with bind mounts and whatever else you're going to be doing. Every argument against using setuid relies solely on CVE numbers, and pushes forward weird contraptions that are also security issues.