I'm confused, surely if apps are depending on old, unsupported runtimes (which therefore likely have security issues), flathub has some interest in ensuring users of these apps are notified of this? I would think a policy of requiring uploads must use a supported runtime would mean active apps would be more likely to be using a supported runtime.

This seems to emphasise that users are far safer with distro-provided apps, as the whole point of distros is to ensure all apps use what are effectively supported flatpak runtimes.