isn’t the distribution managed by the developer themselves?

No, most often it’s not.
Valve literally just had a fiasco with them not long ago with them falsely marking steam as verified when Valve are not the ones packing the Flatpak.