AppArmor under Debian Trixie is of very limited use. UNIX socket mediation and D-Bus mediation does not work (contrary to what the manpage claims), so if a process is permitted to open any single UNIX socket, it can open all UNIX sockets on the system that file permissions allow it to reach. This includes the D-Bus socket, which (among other things) allows a process to escape AppArmor confinement by loading a malicious LD_PRELOAD variable into a systemd user manager.
Difficult to say. AppArmor is frequently not very useful as covered above, but Flatpak has its own set of problems. See:
(Note that Flatpak isn’t necessarily useless or harmful if used carefully by a sufficiently skilled user, the point made by the above site is mostly that it provides very little real-world protection when used casually in the way a usual user would.)
Kicksecure is working on our own application sandboxing framework in an attempt to address the limitations of existing solutions:
The current plan is to use systemd-nspawn as a backend, and write a sophisticated wrapper around it that makes it user-friendly while discouraging unsafe uses. The system being build (sandbox-manager-dist) does not yet exist in any usable form, but systemd-nspawn is available from the Debian repositories. You may be able to use it to do what you want, though it will take some effort.