That isn’t entirely true. You can change it as long as it is done via package overrides or overlays. Sure it rules out just compiling/installing something into your root unless you package it first but you can change it.

I honestly like the fact that it effectively enforces every file in the immutable parts of the OS to be traceable back to some package.

Silverblue and other distros like it fix this by not changing the running system. The pending update just becomes the running system on next boot.

You probably did but, there are two Nvidia entries. I’m assuming you downloaded the one under Modern GPUs because it makes sense for your main PC, but a GTX 970 would need the entry that is under Older/Legacy GPUs.

Correct, but that is why there are two different Nvidia images, bazzite-nvidia and bazzite-nvidia-open. OP just needs to use bazzite-nvidia for the older/legacy cards.

IIRC main Fedora used to not do this until some update crashed people’s sessions including the update process which left their install in an unbootable state.

The ostree based versions like Silverblue avoid this by their updates not touching the running system and instead creating a new folder structure with the updates applied that will be booted into on next boot.

I just use the Firefox flatpak from flathub.

Definitely a strange choice for a distro that pushes flatpak to not use it for the browser by default.

See https://wiki.winehq.org/FAQ#How_good_is_Wine_at_sandboxing_Windows_apps.3F from their FAQ

Are you referring to the ones with excessive sandbox permissions that flathub allows by default? Or is this something else?