Why should this conversation be separate from other conversations about the work to be done? Design is one consideration alongside frontend and backend considerations, which often all intersect and require the same participants. Shifting this discussion to a separate work item can result in disjointed conversations and difficulty finding where a decision was made.

I am concerned with duplicated dependencies though, that's my primary aversion to flatpak/snap/AppImage/etc.

We are very close to full inline components (with css, js logic, and templates).

Although there were some patenting and licensing concerns with GraphQL, these have been resolved to our satisfaction by the relicensing of the reference implementations under MIT, and the use of the OWF license for the GraphQL specification.

Basically, the attackers don't actually have video of you or access to your contacts, and they haven't been able to install malicious code on your computer. In reality, they're taking a password from a database that's available online, sending it to you, and hoping you're scared enough to believe their story and send them bitcoin.

Start working towards compliance now - undertake a cookie audit, document your decisions, and you will have nothing to fear.