That "real solution" (in the form of selinux) hasn't been working desktop apps for 2 decades plus. And desktop apps are indeed apps, and flatpak has permissions that are fine grained enough for their needs (network, camera, filesystem, etc) It's much more convenient to have a gui request for permission than to fiddle with text configs. And it's much more convenient for devs to be aware of the permission system and develop for it, rather than having third party fine grained permission layer broken with each update. You can't provide a workable alternative anyway.