com.spotify.Client VS com.discordapp.Discord

There is nothing "unsafe" about flatpak. In fact for every package on flathub you can see exactly what the "unofficial" packagers do in the corresponding github repository. For example here is the repository for Spotify, if you look at the json manifest file you can see they are repackaging the "official" Snap with the necessary libraries and scripts to support it running as a flatpak. Everything there is open source and able to be examined.

If you click on the "Manifest" link for the package on flathub, it will take you to where the code that packages the app resides. There you can review exactly what the packager does in the json manifest. Here's the one for the Spotify client, for example, which shows where it pulls in dependencies and where it downloads the proprietary code from (in this case they base it on the snap) and what commands it executes while packaging the flatpak.

Try installing it via Flatpak

Flatpaks builds are made to be reproducible. Everything is done openly and you can check how the apps like for example Spotify where made.

Why not just use the flatpak?

Judging by the manifest, the Spotify Flatpak is built from the Spotify Snap.

Here is a discussion about the discord one: https://github.com/flathub/com.discordapp.Discord/issues/90

The flatpak package already uses this by default and we have been since June 2021 (https://github.com/flathub/com.discordapp.Discord/commits/master/disable-breaking-updates.py)

This is apparently a problem with discord that the devs have refused to fix

Please see https://github.com/flathub/com.discordapp.Discord/issues/228 & other links mentioned bellow

Unfortunately, this too seems to be buggy or limited. There is an open bug about this feature here: https://github.com/flathub/com.discordapp.Discord/issues/189

If you have to use Discord (clunky electron app that it is) use the flatpak