In the beginning, Flatpak was seen as savior for the Linux desktop ecosystem by making more applications available for more distributions, possibly packaged by the upstream maintainer, but they didn't realize that Flatpak resp. Flathub are actually just another distro with its own builds, repository, package manager, package format and community.

On the security side it was also seen as the only way forward, but it's just opt-in sandboxing. That's still possible to achieve without flatpak by using the underlying sandboxing tool (bubblewrap), but not as user friendly as using the flatpak provided defaults.

This is true. I wrote a sandbox for applications shipped on an immutable distro last month and it uses all the same portals just fine but no ostree/flatpak whatsoever.

You also can have separate portals implemented with different processes if you, you know, use d-bus properly.