Thank you for taking a look into it. When I switched my PC off I realised that I should have asked whether that error was something that I could/should fix on the device (or in the kernel) or something else in the flatpak-runner.
Now, I understand this is limitation of the old kernel and there might be a workaround. (This is what I love in Linux, there always is a or more workaround. )
I have checked the links you provided for the backport and found this in the second one: backport NO_NEW_PRIVS

I apply this into the S2's kernel and will re-try.

(By the way, with adding this Flatpak support into the kernel, something else also changed because the sneak-peek function started to work there. Thanks for that.)