Steam downloads its own client updates. It's very rare for them to need to update the flatpak itself because usually any updates can be accomplished through the built in updater.
Mesa comes as separate flatpaks which is hidden in the GUI, and is automatically install when you install a flatpak. The system can have multiple versions of the driver installed. When Steam is ready to use a newer Mesa version, it will do it automatically.
Mangohud, on the other hand, is a flatpak you need to install manually via the command line. You should follow the instruction on their Github page for that.
P.S: In case you like a GUI for things. You should install Flatseal, which provide a GUI for configuring flatpaks.
Makes sense, I was wondering how that worked when I saw some of those in my list. Is that another layer to the flatpak, like a Docker layer or are Flatpaks allowed out of their sandboxes to talk to other Flatpaks?
A flatpak can name extensions that are mounted into the running container if they're installed.
or are Flatpaks allowed out of their sandboxes
Be careful when thinking of flatpaks as sandboxes. What they confine is (by default) up to the maintainer of each flatpak, and most of the ones I have audited are very permissive.
You can mitigate this somewhat by editing the permissions of each flatpak before running it for the first time, with the command line or a GUI like flatseal. But that only goes so far, since some of the permissions are not fine-grained enough to provide meaningful sandboxing while still allowing games to run. (For example, shared memory and network access.) You might also consider creating a second linux account just for games, and logging in to that account's desktop when installing or running them.
A Flatpak container is better than nothing, and will probably keep you safe from most programming mistakes, but I wouldn't consider it a security/privacy sandbox by any means. If you want that, a hypervisor-based virtual machine would be better.
I'm not sure on the exact details of how it sources mesa, but you can check what version of mesa steam is using by clicking help in steam, and selecting "Steam Runtime Diagnostics". My flatpak steam install reports that I'm using Mesa 24.0.2-arch1.1, which is the same version I get if I check glxinfo | grep Mesa. I'm assuming that means flatpak Steam is using my system's mesa.
I do have some versions of Mesa installed through flatpak in the form of freedesktop.Platform packages, but they're older versions than what was reported from inside steam.