That’s why runtimes are the way they are: for most simple desktop applications, they shouldn’t really need much on top of what is already included in the GNOME, KDE, or Freedesktop runtime they depend on. (If you’re curious, flatpak run org.gnome.Platform and poke around). Those runtimes get regular updates within each branch for important bug fixes. Alas, many applications add at least one or two external libraries they need to build / distribute themselves, and some applications add a lot of them. But it isn’t like every application bundles its own libssl or something.