> Flatpak now has --device=input to allow an application to access input devices without having access to all devices.

Oh, hey... I made that feature. Nice to see that other people want narrower permissions, too.