It wasn't that long ago they got caught downloading everyone's DNS caches in real time. That means any website you access, Steam lets Gabe know. Also any website you accessed in the past, even while Steam was off at the time.
I don't know how trustworthy these people are, but Common.org rated them worse than they did Facebook.
I'm not an expert on Flatpak, but yes, I believe Flatpak comprehensively protects you from applications snooping on your systemd resolve cache. I was talking about the Windows version of Steam in my previous comment.