steam-desktop-updater VS com.spotify.Client

The basic problem is that the .desktop file will try to launch steam which doesn't exist outside the flatpak sandbox. There are various workarounds in the comments of that issue, including https://github.com/gasinvein/steam-desktop-updater

There's a script that makes desktop entries for your installed Steam games, works well with the Flatpak version: https://github.com/gasinvein/steam-desktop-updater

There is nothing "unsafe" about flatpak. In fact for every package on flathub you can see exactly what the "unofficial" packagers do in the corresponding github repository. For example here is the repository for Spotify, if you look at the json manifest file you can see they are repackaging the "official" Snap with the necessary libraries and scripts to support it running as a flatpak. Everything there is open source and able to be examined.

If you click on the "Manifest" link for the package on flathub, it will take you to where the code that packages the app resides. There you can review exactly what the packager does in the json manifest. Here's the one for the Spotify client, for example, which shows where it pulls in dependencies and where it downloads the proprietary code from (in this case they base it on the snap) and what commands it executes while packaging the flatpak.

Try installing it via Flatpak

Flatpaks builds are made to be reproducible. Everything is done openly and you can check how the apps like for example Spotify where made.

Why not just use the flatpak?

Judging by the manifest, the Spotify Flatpak is built from the Spotify Snap.