I update flatpak through ssh and haven't had this issue. I think you installed it system wide and not for the user, since with user you don't need password at all
E: From the comments it looks like they didn't use sudo to update either. With it it would've asked once. With --user that wouldn't have been necessary ofc.