opi VS com.spotify.Client

This is incorrect. It also installs a set list of packages.

Have you looked into OPI? This allows you to easily search and install community packages from the Open Build System similarly to how it is with working with yay on Arch. It very likely does not contain things like git packages or fonts but it can be pretty useful for packages like ckb-next and since it pulls from the OBS it is always guaranteed to be a binary, no compilation necessary

As of this writing, opi performs the following operations behind the curtains (see here for reference):

opi will implement a workaround in https://github.com/openSUSE/opi/pull/120 which will force the ffmpeg version on tumbleweed to be >=5.

OPI is your friend. You don't have to update every day...once a week or so is fine. Set up multiversion for kernels. A lot of times if a vendor offers a Fedora RPM and not openSUSE, the Fedora RPM will work fine. If you are using Nvidia, wait to update kernels... that's all I can think of. Use and update the wiki as needed, it's a good resource, but can get outdated.

Yeah I'm pretty sure it's using Packman https://github.com/openSUSE/opi

For more information https://github.com/openSUSE/opi

OPI is also useful for finding other packages that aren't in the regular repos

The easiest way to install software is with OPI, you can also search with Zypper or YaST. Generally, if you can find an RPM file built for Fedora, you can install it on Tumbleweed as well - I'm sure there are exceptions.

There is nothing "unsafe" about flatpak. In fact for every package on flathub you can see exactly what the "unofficial" packagers do in the corresponding github repository. For example here is the repository for Spotify, if you look at the json manifest file you can see they are repackaging the "official" Snap with the necessary libraries and scripts to support it running as a flatpak. Everything there is open source and able to be examined.

If you click on the "Manifest" link for the package on flathub, it will take you to where the code that packages the app resides. There you can review exactly what the packager does in the json manifest. Here's the one for the Spotify client, for example, which shows where it pulls in dependencies and where it downloads the proprietary code from (in this case they base it on the snap) and what commands it executes while packaging the flatpak.

Try installing it via Flatpak

Flatpaks builds are made to be reproducible. Everything is done openly and you can check how the apps like for example Spotify where made.

Why not just use the flatpak?

Judging by the manifest, the Spotify Flatpak is built from the Spotify Snap.