The runtime ships with openh264 which is not ideal as many (if not all) h264 videos stutter on the current version; the runtime team works on it. The ffmpeg-full extension would be an equivalent of ffmpeg-libs from rpmfusion, but applications need to opt-in to actually use it. The change has been reverted as it’s not clear whether Mozilla can use it, it’s still being discussed.
Pretty much, yes. I believe flatpak can be configured to be more strict about licensing and user/distribution can mask problematic IDs with flatpak mask command.