Precise location information? Wtf for?

Would it shock you to know that ALL of these are in the Steam terms of service also?

The only really sus one to me is the forced arbitration clause, and Steam also had that til they were pressured to remove it by multiple legal cases, including a class action brought to them by Steam users just last September. It is only sus because it's outdated - companies are generally removing them now rather than adding them. https://www.legal.io/articles/5540864/Valve-Removes-Mandatory-Arbitration-from-Steam-Subscriber-Agreement

RE: remaining top 5 bullet points, 3 of the remaining 4 bullet points are uncontroversial bullet points about anticheat. The fourth is banning modding, which is also just a heavy handed anticheat attempt, and not uncommon for online games to add to their ToS to allow banning at their discretion. Either way its clumsy at the least as some mods can be harmless eg HUD mods for colourblind people and deserves some negativity - but not to this level, given everything else is just so boilerplate.

Collected data types: these are all for if you buy stuff with a credit card / paypal / etc off 2k/parent company Take 2. Remember, they sell games with in-game purchases. They also have an app which has location permissions option which is what the precise location is about.

So yes - again, as OP said, this is nothing controversial if you have paid attention to ToS meaning and content over the past 20 years.

Aside from the forced arbitration crap - which Steam, Microsoft, Amazon, Lyft, Uber, Google, AT&T - and hundreds of other major companies all snuck into their ToS over the years, and many have now been legally pressured to remove by consumer rights group. That is stupid because it shows their legal team is behind the times, companies are mostly removing their forced arbitration clauses nowadays because it has been the cause of many lost class actions.

They know I use Linux and that means they know too much

Not a lot. Even when it isn't a flatpak windows software running on linux won't be able to interact with the system anywhere near as deeply as on windows.

They'll be able to tell it's linux, though.

So…if Steam is running in a Flatpak, and Borderlands is launched from Steam, how much can they even see…really?

Without using exploits to escape the container, not much. A very empty Windows environment with a single game installed, your network interfaces and any directories that the Flatpak has access to (usually just the SteamLibrary directories).

The TOS (https://www.take2games.com/legal/en-US/) changes are mostly related to data that they collect via their interfacing with Steam and through their website. This idea that they're requiring you to agree to a root level access or installing a spyware rootkit is just nonsense.

New to linux...are flatpaks like sandboxed?

You can install an application like Flatseal (https://flathub.org/apps/com.github.tchx84.Flatseal) to inspect the permissions for a flatpak.

How locked down a flatpak is depends entirely on the developer and what permissions they request. By default, they can't really see much. For example, they can't even see the processes running on your host or your user and system files.

Flatpak does not do anything about network access though, it can only do no access or full access, no in between. The data they can collect on Linux in a Flatpak is very limited but it does not prevent them from calling home.