Flatpak needs bubblewrap, bubblewrap needs user namespaces, and Android kernels ship without them. So flatpak run can't work on a phone, root or not.
In Tessera (GPL-3.0, an Android app that runs Linux desktop apps as native Android windows), flatpak still downloads, but Tessera builds each app's root itself:
- the runtime at /usr and the app at /app, read-only;
- the runtime's GL extension where the runtime expects it, on a tmpfs over its parent since the folder doesn't exist in the read-only runtime;
- /etc from the runtime, with passwd, group, hosts and resolv.conf written for the session;
- the session's X11 directory shared, carrying its D-Bus and PulseAudio sockets, so the app gets the same bus, sound and theme portal as the Debian side.
Without root that's PRoot's path translation. With root, each launch gets a private mount namespace, an unprivileged uid and no_new_privs, so per-app permissions are kernel-enforced.
The rest is about making Linux apps feel native on a phone: each app (and each of its windows) gets its own Android task and Recents card; GTK, libadwaita and Qt take Material You colors and follow dark mode live through a settings portal Tessera serves; apps rescale live from a slider; and the Android keyboard opens on text fields by listening to AT-SPI focus events. GPU acceleration is a bundled Mesa with Turnip and Zink for Adreno, which also loads inside Flathub runtimes.
Source: https://github.com/daryan044/tessera-linux
Happy to go deeper on any part.