It was mentioned in a podcast from the linux cast - there was actually a guy (I believe he works for gnome) and he cleaned up with some prejudices about flatpaks. One of them being that they consume too much space on disk ;)

They acutally use deduplication. So if there is a package needed in e.g. 10 different flatpaks it will not take 10x the space on the drive.

Thank you very much!

And thanks for pointing out the security risk. Makes me wonder why this works out of the box on my raspberry. Maybe because I did not set up root user?