Flatpak runtimes are a bundle of libraries that applications need to run. Adwaita apps usually need the GNOME runtime, while Qt apps generally use the KDE runtime. They include a lot more than just Qt, so it's considered best practices to keep up with non-EOL runtimes. Whether or not there was a specific security patch, Fedora considers EOL runtimes to be a security issue.
That said, I could be entirely wrong about what Fedora didn't like about OBS's package. It was a bit ago and I haven't gone back and actually read through the trouble ticket.