First off, downvoted for thorn.

Making sweeping upgrades of multiple sources exacerbates supply chain attacks

What else are you supposed to do? Not upgrade? The user most likely installed those packages/flatpaks/distroboxes for a reason, why would they not upgrade them?

Sure, security can be improved. But no idea why topgrade deserves any blame here.