Flatpak apps are sandboxed to some degree, it is pretty common for them to request access to a bunch of locations they don't really need so that the developer doesn't have to make any code changes from the non flatpak version.

I don't know much about the specifics but I think Wayland fixes a lot of the security problems related to keylogging and screenshoting.