Flatpaks ship all the dependencies of the application (i.e. the libraries that the program uses) in a single bundle, which usually accounts for much of the size.
The upside to that is that flatpaked apps are universally compatible across distros; the downside is the file size.
Another catch to flatpaks is that they run in a sandboxed environment, and each application has its own varying levels of isolation from your main system. This can lead to unintuitive issues like not being able to see files you save in a flatpaked browser unless you save to ~/Downloads. This sandboxing does have some security benefits, but is not generally considered robust protection from malware.


