Note that flatpaks are using systemd's sd_id128_get_machine_app_specific API, which generates an app-specific id that's derived from the original machine-id.
The app-specific id will be unique per-app so it won't be shared between different apps / flatpaks. The apps can't know the original machine-id, but the id they get would still be the same on every restart of the app and in theory does not prevent different sessions within the same app to be fingerprinted as coming from the same user.