I don’t know why a journaling app needs full system access and access to system settings, and the permission Flatseal requests is a dangerous one if you pay attention to these things. Looks like they’re doing their job to me.
Xournal seems pretty trustworthy to me, so I assume it’s for code simplicity (or age) or not being made with Flatpak in mind - just ‘open any file/full filesystem access’’ (for basic functions like opening files) and ‘change system settings’ for probably only a few features that change system settings.
I agree the permissions are dangerous and I commend Flatpak for incentivizing developers to use granular permissions.
As others (and you yourself have said), Flatseal’s entire purpose is to edit Flatpak lermissions, so that one shouldn’t be alarming.