Unofficial Flatpaks are not random uploads

This is already possible

You can’t just upload a App to Flathub. Everythng is reviewed.

How does that Help against Malware?

You may want to take a look at PackageKit

If you try to keep your depencies low, it’s not very cumbersome. I usually do that.

A setup.py/pyproject.toml can replace requirements. txt, but it is for creating packages and does way more than just installing dependencies, so they are not really competing.

For scripts which have just 1 or 2 packges as depencies it’s also usuall to just tell people to run pip install .

Yes, but this file is created by you and not pip. It’s not like package.json from npm. You don’t even need to create this file.

Pip stores nothing in a text file