Not the one you asked, but it’s a case of priorities:
If you want it to just work, then the AUR is probably the better pick. Don’t get me wrong, through; most flatpaks should (mostly) work like how you’d expect them to behave natively.
But, (Op)Sec-wise, the verified flatpaks win. No contest. Simply, because there’s no third party involved in the process. (And I haven’t even gone over flatpaks’ superior sandboxing.)
I’m interested why flathub > AUR? I try to minimize AUR usage but always assumed it’s better than flathub?
Not the one you asked, but it’s a case of priorities: