I am concerned with duplicated dependencies though, that's my primary aversion to flatpak/snap/AppImage/etc.

We are very close to full inline components (with css, js logic, and templates).

Although there were some patenting and licensing concerns with GraphQL, these have been resolved to our satisfaction by the relicensing of the reference implementations under MIT, and the use of the OWF license for the GraphQL specification.

Basically, the attackers don't actually have video of you or access to your contacts, and they haven't been able to install malicious code on your computer. In reality, they're taking a password from a database that's available online, sending it to you, and hoping you're scared enough to believe their story and send them bitcoin.

Start working towards compliance now - undertake a cookie audit, document your decisions, and you will have nothing to fear.