So…if Steam is running in a Flatpak, and Borderlands is launched from Steam, how much can they even see…really?

Without using exploits to escape the container, not much. A very empty Windows environment with a single game installed, your network interfaces and any directories that the Flatpak has access to (usually just the SteamLibrary directories).

The TOS (https://www.take2games.com/legal/en-US/) changes are mostly related to data that they collect via their interfacing with Steam and through their website. This idea that they're requiring you to agree to a root level access or installing a spyware rootkit is just nonsense.