AppImage defended and used grossly outdated core component like FUSE2 for a long time, and comes with zero sandboxing by default.

IMO, flatpak needs to improve in terms of security, but it is a strict improvement over AppImage.