Background-Story: I did a "flatpak update" on a remote client and every package wants the PW for downloading and for installing again. I had to enter the password like 30 times or more.
This was rather an issue of flatpaks being installed for the system, so updating requires root. One option would've been to use sudo and another would've been --user. I guess flatpak could be blamed for defaulting to --system, which I'm not sure if the blame is on flatpak or distros, dunno.