On flatpak Show more
Thankfully, the runtimes get updated with the fixes & apps inherit that.
Yes, the big distros are handling it a bit quicker. This isn't a problem with Flatpak itself though. Hopefully this will improve, especially after this bit of bad press.
Smaller distros have security update problems too.
Traditional packages from 3rd parties (Skype, Chrome, add-on repos) also bundle a lot & have similar update issues.