flatpak works by using bubblewrap which creates namespaces for the applications you use, essentially the root gets swapped for a fake root, this is how docker, podman, etc work.