What isn't clear especially is how they know which of the students in the bathroom was vaping. You could maintain plausible deniability by just only going in between classes for instance.
It should be noted though that flatpaks and related solutions are NOT equivalent to static linking. They do a lot more and serve a wildly different audience than something like Oasis. They are really much too extreme for non-GUI applications, and I would question the competence of anybody found running ordinary programs packaged in that manner.
I recognize that you probably weren't confused on this I'm just clarifying for others since the whole ecosystem can be a bit confusing.