The VLC "vulnerability" debacle shows that there should be a discussion on how libraries work and are packaged. I don't think Flatpak et al are the solution either, but something has to change with @debian and their derivatives (most notably the most recent Ubuntu LTS)