Permission improvements?

--filesystem=home is too broad. Most other flathub game launchers (bottles, steam, and heroic) either keep primary drive games in .var or a specific directory.

--device=all is a known potential sandbox escape vector.
--device=input for gaming controllers
--device=dri for gpu accel

--filesystem=/mnt only has drives mounted here manually, and the drives could easily be mounted anywhere else so I don't think it makes sense to pre-grant this. I think only /run/media makes sense for the steamdeck which you already have.