In general with Linux sites with deb/rpm/etc files would usually include hashes for the genuine versions etc. Not to say the actual author of these could be malicious.

Imho, these hashes are hardly a security feature. If a malicious actor can control the file that you download, they likely can also control the hash.

Even with sandboxing, they generally need access to save files/load files etc from the host environment. Where are these connections defined? Could a malicious actor for example grant their malicious appimage/flatpak more access? Genuine questions, I’ve never looked into how these work.

Good question. I hope there's some form of security present, but I really don't know.

But in the end, the most valuable stuff on a computer is user data anyway. Who needs root on a machine, if the attacker can also encrypt all your personal files?