It’s difficult to police and enforce. It requires manual review of entire code bases. Not doable for them. Not the point of the project either, you use flathub when you don’t want the package system and get something directly from the dev that just works.