of course, but no root permission is needed for that. flatpak packages can be installed on the user level, but even if you somehow disable that, they could still just download firefox (or anything else) as a tarball, unpack it and run it traditionally