touche. I don't think the existence of other threats is a reason to dismiss this one. And I don't think simply prohibiting running random executables is sufficient as it isn't 'most users' who are switching to Linux. The people likely to switch to Linux are also the people likely to want to run programs that aren't yet distributed in repos. I can imagine a scenario where the malware is hidden in a program hosted on a custom flatpak repo and requires permissions for normal operation that'd make flatseal ineffective for stopping the malware.

The ideal anti-virus in my mind would ignore programs installed from official repos and on access scan ones installed from anywhere else. It'd also keep track of critical vulnerabilities to give you a heads up about updating your system.