I think so. In some cases the flatpaks are prepared by the developers themselves. This isn’t in itself a sign of trustworthiness, but if a dev were to sneak malicious code in somewhere and it were found out… Well, the internet is the courtroom, and the public the jury, right?

But, it is a piece of software, and you never know what one little dependency can do. Same can be said about repos.