Does it make sense to only update security packages?
Yes. "Update for security fixes, and then bump versions only when necessary for features" is how updates are supposed to work, but nobody does this.
Or will it even be unstable after updating everything?
RedHat's release engineering is fantastic. I usually give new Fedora releases a month or two before upgrading my work desktop, but normal updates are uneventful.
Fedora is experimental compared to RHEL, but in the grand scheme of things, it's a moderate distro. It does more testing then Arch, they try to upstream as much as possible, they don't ship software with license or patent problems, and it's a semi-rolling release distro. A few packages are pinned, but most packages get updated as the package maintainer has time, which is usually shortly after release.
Wouldn’t it be better to have the applications, which must have the fanciest updates in flatpak and than just update flatpak?
That's up to you. Some people like Flatpak, and some people don't. I also don't know how to only install security updates for Flatpak applications.
I use a mixture. Some programs aren't packaged as a Flatpak, some are only packaged as a Flatpak, and some are better from the distro package.
I've run Fedora and RHEL/CentOS for over a decade at this point, and it's been solid. The times things have gotten weird is when I've added 3rd party repos which replace system packages instead of installing into their own path. This problem has mostly been fixed now.
btw. could you delete the redundant posts, please. You accidentally post it 4 times.
Yeah. I was posting with Remmel, and it's a little wonky. Four errors, four posts. :\