GNOME 3.38 seems to have introduced a new “parental controls” feature and since, I am always prompted for my password when installing flatpaks. I liked the old behaviour better. There seems to be no quick and easy way to change this back. I suppose, one has to do some policykit magic, but what? There is no mention of flatpak in any file in /etc/polkit-1
Just in case anyone else wonders: I purged the packages malcontent and malcontent-gui and this fixed it for me. No small children are using my machine, no need for parental controls.