Comment 6 for bug 2027907

Thanks for verifying!
Yes, the version from the apt repository is likely the old GTK2 version (1.6 or 1.7) and wouldn't be sandboxed

I'm keeping this open to test the GTK4 port of Pinta (upcoming 2.2 release) as a flatpak to verify that this will work without needing extra permissions