They know I use Linux and that means they know too much

Not a lot. Even when it isn't a flatpak windows software running on linux won't be able to interact with the system anywhere near as deeply as on windows.

They'll be able to tell it's linux, though.

So…if Steam is running in a Flatpak, and Borderlands is launched from Steam, how much can they even see…really?

Without using exploits to escape the container, not much. A very empty Windows environment with a single game installed, your network interfaces and any directories that the Flatpak has access to (usually just the SteamLibrary directories).

The TOS (https://www.take2games.com/legal/en-US/) changes are mostly related to data that they collect via their interfacing with Steam and through their website. This idea that they're requiring you to agree to a root level access or installing a spyware rootkit is just nonsense.

You can install an application like Flatseal (https://flathub.org/apps/com.github.tchx84.Flatseal) to inspect the permissions for a flatpak.

How locked down a flatpak is depends entirely on the developer and what permissions they request. By default, they can't really see much. For example, they can't even see the processes running on your host or your user and system files.

Flatpak does not do anything about network access though, it can only do no access or full access, no in between. The data they can collect on Linux in a Flatpak is very limited but it does not prevent them from calling home.

New to linux...are flatpaks like sandboxed?